Description of problem: With mgmt-gateway service running, when the "mgr" daemons are upgraded to a newer image which uses new root CA (cephadm-root-<fsid>) as opposed to old (cephadm-root), the prometheus service fails with below error: 404 - Not Found Could not reach Prometheus's API on https://10.0.66.11:29443/internal/prometheus/api/v1 error HTTPSConnectionPool(host='10.0.66.11', port=29443): Max retries exceeded with url: /internal/prometheus/api/v1/rules (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1147)'))) Version-Release number of selected component (if applicable): ceph 8.1 How reproducible: 1/1 Steps to Reproduce: 1. Install a cluster with 8.0 z stream release (which uses cephadm-root CA) 2. Deploy mgmt-gateway service 3. Upgrade the mgr daemons to the latest 8.1 image using : ceph orch upgrade start <image> --daemon_types mgr 4. Check logs/dashboard Actual results: prometheus fails with error mentioned in the description Expected results: prometheus should not fail Additional info:
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Important: Red Hat Ceph Storage 8.1 security, bug fix, and enhancement updates), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2025:9775