Ceph: Virtualization Storage Ledger 2026 Scorecard

Part of the Virtualization Storage Ledger (edition 2026-10-16). How the scores work: methodology.

Snapshot

Type: engine (open source; packaged commercially by IBM, Red Hat, croit, Proxmox and others)
Owner: No single owner. Ceph Foundation, a directed fund under the Linux Foundation since 2018-11-12; technical governance by the Ceph Steering Committee; the largest employer of core developers moved from Red Hat to IBM on 2023-01-01
Licence: LGPL-2.1 or LGPL-3 for the main code with component exceptions; free, no editions, no licence change found since 2023
Latest release: Tentacle 20.2.4 (2026-08-19); Squid 19.2.7 (2026-10-12); Tentacle 20.2.0 shipped 2025-11-18
Support lifecycle: One named release a year; each stable series gets backports for about two years; point releases every four to six weeks in principle; upgrades tested from the last two stable releases, no downgrade. Reef ended 2026-03-20, Squid estimated 2026-10-31, Tentacle estimated 2027-06-01
Next milestone: Umbrella (21.x): shown as in development at Ceph Days London (June 2026), no GA date published
Hypervisors: QEMU/KVM hosts natively through librbd and the kernel RBD client (Proxmox VE, OpenStack, oVirt, plain libvirt); VMware ESXi only through the NVMe/TCP gateway (docs.ceph.com, rbd/nvmeof-overview) or the iSCSI and NFS gateways; KubeVirt platforms through Rook and ceph-csi; no Hyper-V client found
Tier: Open-source engine
Archetype: Dependable builder
Evidence grade: B. The release table, the Squid and Tentacle release notes, the lifecycle policy, the foundation page and the licence file were read from docs.ceph.com, ceph.io and GitHub. What shipped in Hammer to Quincy (2015 to 2022) is dated from the release table but described from memory of the release notes, so the steps before 2023 are grade B and should be re-read before the next edition.

Scope of the scores: Scored as the upstream project alone: what docs.ceph.com documents and what the release notes say shipped. Support contracts, certified hypervisor plug-ins, FIPS builds and appliances belong to the products built on it and are scored under IBM Storage Ceph, OpenShift Data Foundation, croit and Proxmox VE Ceph.

Scorecard

Dimension	Score	Direction
Capability today	80.5 / 100	higher is better
Momentum since end of 2022	+7.4 points (2015 to 2022: +19.7)	higher is better
Credibility	19.0 / 25	higher is better
Commercial risk	not scored (engine: nothing to buy)
Technical lock-in	7.0 / 25	lower is better
Integrator fit	12.5 / 20	higher is better
AI leverage	3.0 / 20	higher is better
Ledger Index	67.4 / 100	balanced weights; see the methodology

Capability by domain, 2015 to today

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2015	2019	2022	Today
Data services core (15)	2.5	3.5	3.5	4
Resilience and HA (15)	3.5	3.5	4	4.5
Performance and protocols (12)	2	3	3	4
Hypervisor integration (12)	3	3	3	3.5
Scale and topology (10)	4	4.5	4.5	4.5
Data protection and DR (10)	2	3	3.5	3.5
Security (8)	2	2.5	3	3.5
Operations and automation (8)	2	3.5	4	4
Hardware and deployment freedom (5)	5	5	5	5
Kubernetes and containers (5)	0	3	4	4
Total / 100	53.4	68.0	73.1	80.5

Year by year: 2015: 53.4 · 2016: 55.4 · 2017: 58.4 · 2018: 59.2 · 2019: 68.0 · 2020: 68.8 · 2021: 71.3 · 2022: 73.1 · 2023: 75.5 · 2024: 77.0 · 2025: 80.5 · 2026: 80.5

What moved the score

Year	Domain	Change	Points	Trigger
2016	Data protection and DR	2 → 3	+2.0	Jewel: RBD mirroring between clusters (journal based)
2017	Data services core	2.5 → 3.5	+3.0	Luminous: BlueStore default with inline compression; erasure-coded pools accept overwrites so RBD and CephFS can use them
2018	Operations and automation	2 → 2.5	+0.8	Mimic: dashboard v2
2019	Kubernetes and containers	0 → 3	+3.0	Rook 1.0 and ceph-csi: dynamic RBD and CephFS volumes with snapshots, expansion and ReadWriteMany file
2019	Operations and automation	2.5 → 3.5	+1.6	Nautilus: dashboard with REST API, Prometheus module, PG autoscaler
2019	Performance and protocols	2 → 3	+2.4	Nautilus: iSCSI gateway and NFS-Ganesha exports managed from the dashboard; all-flash BlueStore deployments documented
2019	Scale and topology	4 → 4.5	+1.0	Nautilus: PG autoscaler and device classes make growth of mixed pools routine
2019	Security	2 → 2.5	+0.8	Nautilus: msgr2 with on-wire encryption; dashboard roles
2020	Operations and automation	3.5 → 4	+0.8	Octopus: cephadm orchestrator with rolling upgrades; Terraform and Ansible remain community-maintained, the data availability score is still a preview
2021	Data protection and DR	3 → 3.5	+1.0	Pacific: stretch mode gives synchronous two-site protection; snapshot-based RBD mirroring (Octopus) and CephFS mirroring; no orchestrated failover, no immutable block snapshots, no backup vendor integration of its own
2021	Resilience and HA	3.5 → 4	+1.5	Pacific: stretch mode for two-site clusters with a tiebreaker monitor
2022	Kubernetes and containers	3 → 4	+1.0	Rook and ceph-csi: ReadWriteMany block for KubeVirt live migration, topology awareness, operator-based lifecycle; Kubernetes-native management is left to products such as OpenShift Data Foundation
2022	Security	2.5 → 3	+0.8	Quincy: RBD per-image LUKS encryption; server-side encryption with an external KMS for object storage
2023	Hypervisor integration	3 → 3.5	+1.2	Reef: NVMe/TCP gateway gives VMware ESXi a documented path; no vSphere plug-in, no VAAI statement and no Hyper-V client upstream
2023	Performance and protocols	3 → 3.5	+1.2	Reef: NVMe/TCP gateway documented for ESXi and Linux initiators; upstream GA label not found, so counted as half a step
2024	Resilience and HA	4 → 4.5	+1.5	Squid 19.2.0: MSR CRUSH rule type places erasure-coded chunks across failure domains more flexibly; 20.2.1 (2026-04-06) adds NVMe-oF gateway fast failover
2025	Data services core	3.5 → 4	+1.5	Tentacle 20.2.0: FastEC partial reads and writes on erasure-coded pools (per-pool flag), improved BlueStore compression; still no deduplication and no per-volume minimum QoS
2025	Performance and protocols	3.5 → 4	+1.2	Tentacle 20.2.0: SMB manager module with Samba on CephFS; NVMe/TCP gateway groups and multiple namespaces in the dashboard; no Fibre Channel, RDMA not mainstream, no independent benchmarks published by the project
2025	Security	3 → 3.5	+0.8	Tentacle 20.2.0: oauth2-proxy single sign-on and certmgr for service certificates; 20.2.4 and Squid 19.2.6 (2026-08-19) fix the CephX authentication bypass CVE-2025-30156 and three more CVEs, and every key must be renewed. No FIPS validation, no anomaly detection, no immutable block snapshots

Direction, 2023 to 2026

Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2023-08	Reef 18.2.0: NVMe/TCP gateway documented for block access from ESXi and Linux	Performance	V
2023-08	Reef 18.2.0: RADOS and RBD performance work; release landed in August against a spring target	Packaging	C
2024-09	Squid 19.2.0: MSR CRUSH rule type for flexible erasure-coded layouts	Resilience	C
2024-09	Squid 19.2.0: Crimson and SeaStore first technology preview	Performance	V
2024-09	Squid 19.2.0: RGW user accounts with AWS-compatible IAM	Security	C
2025-04	Reef 18.2.5 to 18.2.7: hotfix for a critical BlueStore regression within a month	Operations	C
2025-07	Squid 19.2.3: RGW STS authentication bypass CVE-2023-43040 and JWT algorithm restriction CVE-2024-48916 fixed	Security	C
2025-11	Tentacle 20.2.0: FastEC partial reads and writes on erasure-coded pools	Data services	C
2025-11	Tentacle 20.2.0: SMB manager module with Samba on CephFS; NVMe/TCP gateway groups in the dashboard	Performance	C
2025-11	Tentacle 20.2.0: cephadm management gateway, oauth2-proxy single sign-on and certmgr	Security	C
2025-11	Tentacle 20.2.0: SeaStore with Crimson and the data availability score stay technology previews	Operations	V
2026-03	Reef 18.2.8: final release, Reef end of life on the published date	Packaging	U
2026-04	Tentacle 20.2.1: NVMe-oF gateway fast failover overhaul, RBD exclusive-transient lock mode	Resilience	C
2026-06	Tentacle 20.2.2: Rocky Linux 10 packages	Packaging	C
2026-06	Umbrella (21.x) shown as in development at Ceph Days London, no date	Packaging	V
2026-08	Tentacle 20.2.3: configurable delayed NVMe-oF failback, NVMe-oF manager module, RGW mTLS for Kafka notifications	Operations	C
2026-08	Tentacle 20.2.4 and Squid 19.2.6: CephX authentication bypass CVE-2025-30156 and three more CVEs fixed; all keys must be renewed	Security	C
2026-10	Squid 19.2.7: backports only; Squid end of life estimated 2026-10-31	Packaging	U

Centre of gravity: Packaging (5), Security (4), Performance (3)
Blind spots (no items): Hypervisor integration, Scale, Data protection, Hardware, Kubernetes, Licensing, AI
Driver mix: Vision 22%, Customer need 67%, Market window 0%, Upstream 11%, Portfolio 0%
Idea-to-need index: 0.25 (0 = demand-pulled, 1 = thesis-pushed)

Credibility: 19.0 / 25

Criterion	Score	Basis
Cadence	3.5	Published annual cycle and four to six week point releases; the named release has landed between August and November since Quincy, and Squid went 11 months between 19.2.3 and 19.2.4
Roadmap transparency	4	Open tracker, public release notes and developer summits; no dated roadmap, Umbrella has no published date
Say-do	3.5	Features announced in release notes ship with the release; Crimson and SeaStore have stayed previews since 2024-09
Velocity	4.5	Several substantive capabilities per named release: MSR rules and IAM accounts in Squid, FastEC, SMB and NVMe-oF failover in Tentacle
Lifecycle stability	3.5	About two years of backports per series, upgrades tested from the last two releases, no downgrade; the Reef 18.2.5 regression needed a hotfix and the Squid point-release gap broke the stated rhythm

Commercial risk: not scored

This is an engine: nobody sells it, so there are no commercial terms to score.

Technical lock-in: 7.0 / 25 (lower is better)

Criterion	Score	Basis
Formats	0.5	Standard RBD images (export to raw or qcow2), POSIX file system, S3-compatible object
Export path	1.5	rbd export, qemu-img and the NFS, SMB and NVMe/TCP gateways let data be copied out; no one-step export
Stack coupling	2.5	Needs Ceph clients in the kernel or QEMU, or a gateway; VMware and Hyper-V reach it only through gateways
Hardware / cloud coupling	0	Any x86 or Arm server, fully offline
Skills and tooling coupling	2.5	Specialised operations skills; tooling (cephadm, Rook, dashboard) is open

Integrator fit: 12.5 / 20

Criterion	Score	Basis
Partner programme openness	4	Anyone may build, package and sell support on it; Ceph Foundation membership is open in three tiers; no vendor programme with margins or certification
Multi-tenancy and self-service	3	Pools, RBD namespaces, CephFS subvolumes and RGW accounts with IAM (Squid); no portal or metering
API and infrastructure-as-code	3.5	REST manager API and dashboard; Rook for Kubernetes; Terraform and Ansible content is community-maintained
Skills and certification	2	No vendor-neutral certification found; training comes from the packaging vendors

AI leverage: 3.0 / 20

How the product uses AI, scored per year like capability. Only GA counts.

Criterion	2019	2022	Today	Latest step
AI workload infrastructure	1	1	1	2015: S3 (RGW) and CephFS serve as training data stores; no GPU data path, RDMA is not a documented mainstream option
AI platform stack	0	0	0	2015: None
AI-assisted operations	0	0	0	2015: None; the data availability score (Tentacle) is a rule-based preview
Agent openness	2	2	2	2015: REST manager API with tokens and a CLI agents can drive; no official MCP server found

Year by year: 2015: 3 · 2016: 3 · 2017: 3 · 2018: 3 · 2019: 3 · 2020: 3 · 2021: 3 · 2022: 3 · 2023: 3 · 2024: 3 · 2025: 3 · 2026: 3

AI say-do, 2023 to 2026: 0 AI items announced; 0 GA, 0 still preview, 0 pending, 0 dropped. The project announced no AI feature between 2023 and 2026; a community blog post on using AI to brief remote hands (2026-10) is not a product feature.

Ceph uses no AI in its own operation and offers none to operators; its role in AI is as the object and file store under other platforms. Agents can drive it through the REST API, and nothing more specific exists upstream.

Reading

Ceph scores as the deepest engine in this group because almost every capability a packaging vendor sells already exists upstream: erasure coding with FastEC, stretch mode, NVMe/TCP and SMB gateways, cephadm and Rook. What it lacks is exactly what the products add: a support contract, a vSphere plug-in, FIPS builds, a two-node option and anyone to call when the CephX keys need renewing. The security line sits at 3.5 because the 2026-08-19 fixes repaired a bypass in the authentication protocol itself and the project has no FIPS validation or anomaly detection. The one thing to check before relying on it is which stable series your packaging vendor ships and how far behind upstream its point releases run, because Squid reaches end of life around 2026-10-31.

Open questions and items to re-score

Whether the NVMe-oF gateway carries a technology preview or GA label upstream was not found on docs.ceph.com; it is counted as half a step from Reef.
The 11 month gap between Squid 19.2.3 (2025-07-28) and 19.2.4 (2026-06-01) in the release table should be confirmed before quoting.
Umbrella (21.x) has no published date; the keynote PDF could not be read.
The current Premier member roster of the Ceph Foundation was not read.
Capability steps for Hammer to Quincy (2015 to 2022) are described from memory of the release notes and should be re-read.
Whether a vendor-neutral Ceph certification exists was not confirmed.

	’16	’17	’18	’19	’20	’21	’22	’23	’24	’25
Data services core		1								1
Resilience and HA						1			1
Performance and protocols				2				1		2
Hypervisor integration								2
Scale and topology
Data protection and DR	1					2
Security							2			3
Operations and automation			1	3	1
Hardware and deployment freedom
Kubernetes and containers				1			1