Hi,
updating ceph 18 (trixie) for the recent CVEs is a bit troublesome..
first, trixie currently has ceph 18.2.7, the latest 18.2.x is 18.2.8 so
ideally I would like to update trixie to 18.2.8. The diff is rather
large (huge even, if changes in the generated doc files are not filtered
out), but it's very well tested and vetted by upstream, and also I can
easily verify that with our production cluster as well before. For
bookworm, we also did it similarly by even directly moving from 16.2.11
to 16.2.15 via SRM. For trixie, can I do the CVE fixes based on 18.2.8
or do you want me to backport all back to 18.2.7?
second, since ceph 18 is EOL and upstream will not provide an update for
the recent CVEs, we need to cherry-pick and backport the patches from
ceph 19 to ceph 18 ourselfs, but this isn't straight forward for now:
* the actual fixes itself are spread over a bunch of commits (that's
the easiest one :)
* the fixes require the introduction of a entirely new CephX cryptokey
type, which requires additional patches for the compatibility
handling in "mixed" key situations and do add warnings/checks/etc
for that in the cluster health handling. this will require
exceptionally well and broad testing.
* due to the above, following the 19.2.6 release (which we would take
the CVE fixes from), upstream pushed additional corrections and
adjustments (not passed their QR nor released yet), so, the work of
getting the CVEs fixes "operationally proper" integrated for actual
deployment is still ongoing.
so, in summary and fyi: regardless of 18.2.7 vs 18.2.8, this will likely
take much more time to prepare the patches and test the patches, and I
haven't looked at Ceph 16.x at all yet either. :(
Due to other planned events at work, I'm not able to start doing any of
the above before Thursday next week.
Regards,
Daniel
