From ed8a1eff70c930ef3c7dfa81ea148efc0a528c29 Mon Sep 17 00:00:00 2001 From: Bartosz Bezak Date: Wed, 26 Aug 2026 12:53:14 +0200 Subject: [PATCH] [2024.1-only] ceph: Move EL9 images from Reef to Squid Ceph Reef is end of life and does not have the fixes for CVE-2025-30156, CVE-2026-39944, CVE-2026-50152 and CVE-2026-54330 The CentOS Storage SIG only has Squid 19.2.5 for el9, so take the el9 client packages from download.ceph.com. Ubuntu Jammy and Debian Bookworm images are left as they are. Jammy has Reef and Bookworm has Pacific 16.2.15. download.ceph.com does have Squid for both, so they can be fixed, but that needs its own change. Change-Id: If9ee16e4469e5e5e10bb1e5927967cecde0e26a8 Signed-off-by: Bartosz Bezak (cherry picked from commit ae83d8d2ec3838b1f20c41a28085a71feb916413) --- doc/source/ceph_versions.csv | 2 +- docker/base/Dockerfile.j2 | 6 ++++++ docker/base/ceph.repo | 6 ++++++ kolla/template/repos.yaml | 8 ++++---- kolla/tests/test_methods.py | 4 ++-- .../notes/ceph-squid-el9-3f1d7a0c95b4e28d.yaml | 14 ++++++++++++++ 6 files changed, 33 insertions(+), 7 deletions(-) create mode 100644 docker/base/ceph.repo create mode 100644 releasenotes/notes/ceph-squid-el9-3f1d7a0c95b4e28d.yaml diff --git a/doc/source/ceph_versions.csv b/doc/source/ceph_versions.csv index acfe9a9998..9042bcbc14 100644 --- a/doc/source/ceph_versions.csv +++ b/doc/source/ceph_versions.csv @@ -1,5 +1,5 @@ Distro,Ceph, ,Source, Release -Rocky Linux,CentOS Storage SIG,Reef +Rocky Linux,download.ceph.com,Squid Ubuntu,Ubuntu,Reef Debian,Debian,Pacific diff --git a/docker/base/Dockerfile.j2 b/docker/base/Dockerfile.j2 index a52e513005..9dbc56aa1f 100644 --- a/docker/base/Dockerfile.j2 +++ b/docker/base/Dockerfile.j2 @@ -63,6 +63,12 @@ COPY dnf.conf /etc/dnf/dnf.conf 'td.repo', ] %} +# NOTE(bbezak): The CentOS Storage SIG only built Ceph Squid 19.2.5 for el9, +# which misses the 19.2.6 CVE fixes, so get Ceph from download.ceph.com here. +{% set base_yum_repo_files = base_yum_repo_files + [ + 'ceph.repo', +] %} + {% set base_yum_url_packages = [ ] %} diff --git a/docker/base/ceph.repo b/docker/base/ceph.repo new file mode 100644 index 0000000000..c5648d6a14 --- /dev/null +++ b/docker/base/ceph.repo @@ -0,0 +1,6 @@ +[ceph-squid] +name = Ceph Squid +baseurl = https://download.ceph.com/rpm-squid/el9/$basearch +gpgcheck = 1 +enabled = 0 +gpgkey = https://download.ceph.com/keys/release.asc diff --git a/kolla/template/repos.yaml b/kolla/template/repos.yaml index 6c1c1bd6b6..810484ea11 100644 --- a/kolla/template/repos.yaml +++ b/kolla/template/repos.yaml @@ -1,6 +1,6 @@ --- centos: - ceph: "centos-ceph-reef" + ceph: "ceph-squid" crb: "crb" epel: "epel" erlang: "rabbitmq_rabbitmq-erlang" @@ -18,7 +18,7 @@ centos: rabbitmq: "rabbitmq_rabbitmq-server" centos-aarch64: - ceph: "centos-ceph-reef" + ceph: "ceph-squid" crb: "crb" epel: "epel" erlang-26: "copr-rabbitmq-erlang-26" @@ -147,7 +147,7 @@ debian-aarch64: gpg_key: "rabbitmq.gpg" rocky: - ceph: "centos-ceph-reef" + ceph: "ceph-squid" crb: "crb" epel: "epel" erlang: "rabbitmq_rabbitmq-erlang" @@ -165,7 +165,7 @@ rocky: rabbitmq: "rabbitmq_rabbitmq-server" rocky-aarch64: - ceph: "centos-ceph-reef" + ceph: "ceph-squid" crb: "crb" epel: "epel" erlang-26: "copr-rabbitmq-erlang-26" diff --git a/kolla/tests/test_methods.py b/kolla/tests/test_methods.py index e55bc2a537..a178d4cd80 100644 --- a/kolla/tests/test_methods.py +++ b/kolla/tests/test_methods.py @@ -55,7 +55,7 @@ def test_enable_repos_centos_multiple(self): result = methods.handle_repos(template_vars, ['grafana', 'ceph'], 'enable') expectCmd = 'RUN dnf config-manager --enable grafana ' - expectCmd += '--enable centos-ceph-reef || true' + expectCmd += '--enable ceph-squid || true' self.assertEqual(expectCmd, result) def test_enable_repos_debian(self): @@ -167,7 +167,7 @@ def test_disable_repos_centos_multiple(self): result = methods.handle_repos(template_vars, ['grafana', 'ceph'], 'disable') expectCmd = 'RUN dnf config-manager --disable grafana ' - expectCmd += '--disable centos-ceph-reef || true' + expectCmd += '--disable ceph-squid || true' self.assertEqual(expectCmd, result) # NOTE(hrw): there is no disabling of repos for Debian/Ubuntu diff --git a/releasenotes/notes/ceph-squid-el9-3f1d7a0c95b4e28d.yaml b/releasenotes/notes/ceph-squid-el9-3f1d7a0c95b4e28d.yaml new file mode 100644 index 0000000000..0c3830d08f --- /dev/null +++ b/releasenotes/notes/ceph-squid-el9-3f1d7a0c95b4e28d.yaml @@ -0,0 +1,14 @@ +--- +security: + - | + Ceph in Rocky Linux 9 and CentOS Stream 9 images is updated from Reef + 18.2.8 to Squid 19.2.6. This fixes CVE-2025-30156, CVE-2026-39944, + CVE-2026-50152 and CVE-2026-54330. The packages come from + download.ceph.com, because the CentOS Storage SIG only built Squid 19.2.5 + for el9. +upgrade: + - | + On Rocky Linux 9 and CentOS Stream 9 the Ceph repository is now + ``ceph-squid`` at ``https://download.ceph.com/rpm-squid/el9``, and no + longer ``centos-ceph-reef``. If you mirror repositories, add a mirror of + the new one and use the new name.