canonical / canonical/microceph
Track removal of cephadm adoption compatibility pin
- Dominant language
- Go
- Stars
- 396
- Forks
- 74
- Avg merge
- 2d 20h
- Merged PRs (30d)
- 7
Description
## Context
PR #825 pins the cephadm adoption fixture to `quay.io/ceph/ceph:v19.2.5`. The bundled MicroCeph Ceph 20.2.1 client cannot authenticate with the AES256KRB5 CephX key format emitted by Ceph 19.2.6.
## Why this needs tracking
CVE-2025-30156 is fixed in Ceph 19.2.6 and 20.2.4. The temporary 19.2.5 fixture pin preserves compatibility with the current MicroCeph snap, but keeps the fixture on the pre-fix Ceph release.
- CVE: https://docs.ceph.com/en/latest/security/CVE-2025-30156/
- Upstream compatibility change: https://github.com/ceph/ceph/commit/13063f42c2add051a4c4ac812597390eaa29c74c
## Exit criteria
1. The MicroCeph snap bundles Ceph 20.2.4 or later.
2. The cephadm adoption fixture removes the 19.2.5 pin and exercises a 19.2.6-or-later producer image.
3. The adoption test proves the newer CephX key format works without exposing the credential in CI logs.
Contributor guide
Research direction
Read PR #825 and inspect the cephadm adoption fixture and test it changed; the issue does not name their file paths. First confirm the MicroCeph snap bundles Ceph 20.2.4 or later, then check that the fixture uses a 19.2.6-or-later producer and the adoption test verifies the newer CephX key format without logging credentials.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- testing
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100