canonical / canonical/microceph

Track removal of cephadm adoption compatibility pin

Open
#826 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
396
Forks
74
Avg merge
2d 20h
Merged PRs (30d)
7

Description

## Context

PR #825 pins the cephadm adoption fixture to `quay.io/ceph/ceph:v19.2.5`. The bundled MicroCeph Ceph 20.2.1 client cannot authenticate with the AES256KRB5 CephX key format emitted by Ceph 19.2.6.

## Why this needs tracking

CVE-2025-30156 is fixed in Ceph 19.2.6 and 20.2.4. The temporary 19.2.5 fixture pin preserves compatibility with the current MicroCeph snap, but keeps the fixture on the pre-fix Ceph release.

- CVE: https://docs.ceph.com/en/latest/security/CVE-2025-30156/
- Upstream compatibility change: https://github.com/ceph/ceph/commit/13063f42c2add051a4c4ac812597390eaa29c74c

## Exit criteria

1. The MicroCeph snap bundles Ceph 20.2.4 or later.
2. The cephadm adoption fixture removes the 19.2.5 pin and exercises a 19.2.6-or-later producer image.
3. The adoption test proves the newer CephX key format works without exposing the credential in CI logs.

Contributor guide

Open the contributing guide

Research direction

Read PR #825 and inspect the cephadm adoption fixture and test it changed; the issue does not name their file paths. First confirm the MicroCeph snap bundles Ceph 20.2.4 or later, then check that the fixture uses a 19.2.6-or-later producer and the adoption test verifies the newer CephX key format without logging credentials.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
testing
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.