From ae83d8d2ec3838b1f20c41a28085a71feb916413 Mon Sep 17 00:00:00 2001 From: Bartosz Bezak Date: Wed, 26 Aug 2026 12:53:14 +0200 Subject: [PATCH 1/2] [2025.1-only] ceph: Move EL9 images from Reef to Squid Ceph Reef is end of life and does not have the fixes for CVE-2025-30156, CVE-2026-39944, CVE-2026-50152 and CVE-2026-54330. The CentOS Storage SIG only has Squid 19.2.5 for el9, so take the el9 client packages from download.ceph.com. el10 keeps using the Storage SIG, which has 19.2.6. Ubuntu Noble images are left as they are. Ubuntu still ships 19.2.3 and download.ceph.com has no Squid packages for Noble. Debian Bookworm images still have Pacific 16.2.15. download.ceph.com does have Squid for Bookworm, so that one can be fixed, but it is a bigger jump and needs its own change. Change-Id: If9ee16e4469e5e5e10bb1e5927967cecde0e26a8 Signed-off-by: Bartosz Bezak --- doc/source/ceph_versions.csv | 2 +- docker/base/Dockerfile.j2 | 9 +++++++++ docker/base/ceph.repo | 6 ++++++ kolla/template/repos.yaml | 8 ++++---- kolla/tests/test_methods.py | 4 ++-- .../notes/ceph-squid-el9-3f1d7a0c95b4e28d.yaml | 14 ++++++++++++++ 6 files changed, 36 insertions(+), 7 deletions(-) create mode 100644 docker/base/ceph.repo create mode 100644 releasenotes/notes/ceph-squid-el9-3f1d7a0c95b4e28d.yaml diff --git a/doc/source/ceph_versions.csv b/doc/source/ceph_versions.csv index eed1141aa8..8a549322d3 100644 --- a/doc/source/ceph_versions.csv +++ b/doc/source/ceph_versions.csv @@ -1,6 +1,6 @@ Distro,Ceph, ,Source, Release -Rocky Linux 9,CentOS Storage SIG,Reef +Rocky Linux 9,download.ceph.com,Squid Rocky Linux 10,CentOS Storage SIG,Squid Ubuntu,Ubuntu,Squid Debian,Debian,Pacific diff --git a/docker/base/Dockerfile.j2 b/docker/base/Dockerfile.j2 index 82126a8a9f..c0f895ac3b 100644 --- a/docker/base/Dockerfile.j2 +++ b/docker/base/Dockerfile.j2 @@ -63,6 +63,15 @@ COPY dnf.conf /etc/dnf/dnf.conf 'td.repo', ] %} +{% if base_distro_tag.startswith('9') or base_distro_tag.startswith('stream9') %} +# NOTE(bbezak): The CentOS Storage SIG only built Ceph Squid 19.2.5 for el9, +# which misses the 19.2.6 CVE fixes, so get Ceph from download.ceph.com here. +# el10 keeps using centos-release-ceph-squid. + {% set base_yum_repo_files = base_yum_repo_files + [ + 'ceph.repo', + ] %} +{% endif %} + {% set base_yum_url_packages = [ ] %} diff --git a/docker/base/ceph.repo b/docker/base/ceph.repo new file mode 100644 index 0000000000..c5648d6a14 --- /dev/null +++ b/docker/base/ceph.repo @@ -0,0 +1,6 @@ +[ceph-squid] +name = Ceph Squid +baseurl = https://download.ceph.com/rpm-squid/el9/$basearch +gpgcheck = 1 +enabled = 0 +gpgkey = https://download.ceph.com/keys/release.asc diff --git a/kolla/template/repos.yaml b/kolla/template/repos.yaml index 437b67a138..6c0b0cdef8 100644 --- a/kolla/template/repos.yaml +++ b/kolla/template/repos.yaml @@ -1,6 +1,6 @@ --- centos: - ceph: "centos-ceph-reef" + ceph: "ceph-squid" crb: "crb" docker-ce: "docker-ce" epel: "epel" @@ -20,7 +20,7 @@ centos: rabbitmq: "rabbitmq_rabbitmq-server" centos-aarch64: - ceph: "centos-ceph-reef" + ceph: "ceph-squid" crb: "crb" docker-ce: "docker-ce" epel: "epel" @@ -171,7 +171,7 @@ debian-aarch64: gpg_key: "rabbitmq.gpg" rocky: - ceph: "centos-ceph-reef" + ceph: "ceph-squid" crb: "crb" docker-ce: "docker-ce" epel: "epel" @@ -191,7 +191,7 @@ rocky: rabbitmq: "rabbitmq_rabbitmq-server" rocky-aarch64: - ceph: "centos-ceph-reef" + ceph: "ceph-squid" crb: "crb" docker-ce: "docker-ce" epel: "epel" diff --git a/kolla/tests/test_methods.py b/kolla/tests/test_methods.py index e55bc2a537..a178d4cd80 100644 --- a/kolla/tests/test_methods.py +++ b/kolla/tests/test_methods.py @@ -55,7 +55,7 @@ def test_enable_repos_centos_multiple(self): result = methods.handle_repos(template_vars, ['grafana', 'ceph'], 'enable') expectCmd = 'RUN dnf config-manager --enable grafana ' - expectCmd += '--enable centos-ceph-reef || true' + expectCmd += '--enable ceph-squid || true' self.assertEqual(expectCmd, result) def test_enable_repos_debian(self): @@ -167,7 +167,7 @@ def test_disable_repos_centos_multiple(self): result = methods.handle_repos(template_vars, ['grafana', 'ceph'], 'disable') expectCmd = 'RUN dnf config-manager --disable grafana ' - expectCmd += '--disable centos-ceph-reef || true' + expectCmd += '--disable ceph-squid || true' self.assertEqual(expectCmd, result) # NOTE(hrw): there is no disabling of repos for Debian/Ubuntu diff --git a/releasenotes/notes/ceph-squid-el9-3f1d7a0c95b4e28d.yaml b/releasenotes/notes/ceph-squid-el9-3f1d7a0c95b4e28d.yaml new file mode 100644 index 0000000000..a1316ae5e9 --- /dev/null +++ b/releasenotes/notes/ceph-squid-el9-3f1d7a0c95b4e28d.yaml @@ -0,0 +1,14 @@ +--- +security: + - | + Ceph in Rocky Linux 9 and CentOS Stream 9 images is updated from Reef + 18.2.8 to Squid 19.2.6. This fixes CVE-2025-30156, CVE-2026-39944, + CVE-2026-50152 and CVE-2026-54330. The packages come from + download.ceph.com, because the CentOS Storage SIG only built Squid 19.2.5 + for el9. Rocky Linux 10 images already have Squid 19.2.6 from the SIG. +upgrade: + - | + On Rocky Linux 9 and CentOS Stream 9 the Ceph repository is now + ``ceph-squid`` at ``https://download.ceph.com/rpm-squid/el9``, and no + longer ``centos-ceph-reef``. If you mirror repositories, add a mirror of + the new one and use the new name. From 59814ad828c4e40d77463e242769d8df5edd6342 Mon Sep 17 00:00:00 2001 From: Bartosz Bezak Date: Wed, 26 Aug 2026 16:37:05 +0200 Subject: [PATCH 2/2] Don't build releaser image on CentOS Stream 9 The releases repo dropped support for Python 3.9, so let's just stop building the image there. This is a follow up to I70e244cb289202080a78066f899b9eb24faa5cdc, which did the same for Rocky 9. Change-Id: Ia06f374aee4932e36d13c4944a0f7fd6861e1341 Signed-off-by: Bartosz Bezak --- kolla/image/unbuildable.py | 1 + 1 file changed, 1 insertion(+) diff --git a/kolla/image/unbuildable.py b/kolla/image/unbuildable.py index f85317322f..745f2aae03 100644 --- a/kolla/image/unbuildable.py +++ b/kolla/image/unbuildable.py @@ -29,6 +29,7 @@ }, 'centos+stream9': { + "releaser", # releases repo no longer supports py3.9 }, 'centos+stream10': {