#1151136 ceph-mgr: RESTful module fails due to PyO3 cryptography/OpenSSL incompatibility on Debian Trixie

Package:
ceph-mgr
Source:
ceph-mgr
Description:
manager for the ceph distributed file system
Submitter:
Date:
2026-10-17 13:13:02 UTC
Severity:
normal
#1151136#5
Date:
2026-10-17 12:30:55 UTC
From:
To:
Dear Maintainer,

I am reporting another Python compatibility issue affecting Ceph Reef 18.2.7 on Debian 13 (Trixie).

The Ceph manager’s RESTful module fails during initialization when importing the Python OpenSSL and cryptography libraries.

The import chain reaches:

OpenSSL/__init__.py
OpenSSL/SSL.py
cryptography/x509/
cryptography.hazmat.bindings._rust
The resulting exception is:

ImportError: PyO3 modules may only be initialized
once per interpreter process
Environment

Distribution: Debian GNU/Linux 13 (Trixie)
Ceph: Reef 18.2.7
Package: ceph-mgr 18.2.7+ds-1+deb13u2
Deployment: Native Debian packages managed by systemd
Architecture: amd64
Cluster: Three-node Ceph deployment
Problem description

The Ceph manager loads Python-based manager modules using embedded Python interpreters.

The RESTful module imports OpenSSL and cryptography dependencies, eventually reaching the Rust-backed PyO3 extension provided by the cryptography package.

This extension fails during initialization in the manager’s Python interpreter environment.

The failure appears related to compatibility between Ceph Reef’s embedded Python interpreter architecture and newer Python packages containing PyO3 extensions.

This is similar in nature to a previously encountered issue involving the bcrypt dependency, where importing a Rust-backed Python extension caused manager-module initialization failures.

Expected behavior

The RESTful manager module should initialize successfully using the Python dependencies supplied by Debian Trixie without requiring local modifications to Ceph’s installed Python source files.

Actual behavior

The module fails during Python dependency initialization, generating manager-module errors and crash reports.

Additional information

The installation has also encountered separate Ceph manager compatibility issues involving bcrypt and missing MgrModule.NOTIFY_TYPES attributes.

A related report has already been submitted as Debian bug #1151061.

I would appreciate investigation into whether the RESTful module’s dependency initialization can be made compatible with the Python and cryptography versions shipped by Debian 13, or whether an appropriate Debian packaging fix is required.


Thank you for maintaining Ceph in Debian.