Skip to content

[cifmw_cephadm] Allow legacy CephX while daemons use aes256k #4130

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rebtoor wants to merge 1 commit into
base: main
Choose a base branch
from
+50 −5
Open

[cifmw_cephadm] Allow legacy CephX while daemons use aes256k #4130

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 33 additions & 4 deletions hooks/playbooks/ceph.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -372,6 +372,10 @@
all_addresses: ansible_all_ipv6_addresses
cidr: 64

# OpenStack service images still ship librados that only understands
# CephX type aes. CVE-2025-30156: keep daemons on aes256k via
# auth_allowed_ciphers, but mint client.openstack as aes until those
# images are upgraded. Do not set auth_preferred_cipher.
- name: Generate a cephx key
cephx_key:
cipher: "{{ cifmw_ceph_key_cipher | default('aes') }}"
Expand All @@ -386,11 +390,36 @@
mode: '0600'
caps:
mgr: allow *
mon: profile rbd
osd: "{{ pools | map('regex_replace', '^(.*)$',
'profile rbd pool=\\1') | join(', ') }}"
mon: allow r, profile rbd
osd: "{{ _cifmw_cephadm_osd_caps }}"
vars:
pools: "{{ cifmw_cephadm_pools | map(attribute='name') | list }}"
_cifmw_cephadm_rbd_pools: >-
{{
cifmw_cephadm_pools
| selectattr('application', 'equalto', 'rbd')
| map(attribute='name')
| list
}}
_cifmw_cephadm_cephfs_pools: >-

@fmount fmount Aug 21, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok this worked in the past and probably changed with the new release. To give more context, this applied profile rbd pool=X to every pool, including the CephFS pools (cephfs.cephfs.meta and cephfs.cephfs.data) and while working, it was wrong.
I assume that on older Ceph releases this happened to work because cap validation was more flexible, but Ceph Tentacle (v20) enforces stricter cephx cap validation, causing RADOS permission denied errors when Manila try to access CephFS-backed pools.
Is that the case? @fultonj to double check.

{{
cifmw_cephadm_pools
| selectattr('application', 'equalto', 'cephfs')
| map(attribute='name')
| list
}}
_cifmw_cephadm_osd_caps: >-
{{
(
_cifmw_cephadm_rbd_pools
| map('regex_replace', '^(.*)$', 'profile rbd pool=\\1')
| list
+ (
_cifmw_cephadm_cephfs_pools
| map('regex_replace', '^(.*)$', 'allow rw pool=\\1')
| list
)
) | join(', ')
}}
no_log: "{{ cifmw_nolog | default(true) | bool }}"

# for deploying external ceph for 17.1 using cifmw, we need this playbook to create keyring
Expand Down
12 changes: 11 additions & 1 deletion roles/cifmw_cephadm/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -136,6 +136,16 @@ that they do not need to be changed for a typical EDPM deployment.
`ceph mon set auth_allowed_ciphers <value>` during cluster configuration.
Example values are `"aes,aes256k"` or `"aes256k"` or `"aes"`.
Defaults to `""` (unset, no command is run).
For Tentacle (v20) HCI with older OpenStack librados, set
`"aes,aes256k"` so daemons can use `aes256k` while `client.openstack`
keys of type `aes` still authenticate (CVE-2025-30156). Do not set
`auth_preferred_cipher` until Glance/Cinder/Manila images understand
`aes256k`.

* `cifmw_ceph_key_cipher`: (String) Cipher passed to the `cephx_key` module
when generating `client.openstack`. Defaults to `aes`. Keep `aes` for
OpenStack clients until service images ship librados that understands
`aes256k`.

Use the `cifmw_cephadm_pools` list of dictionaries to define pools for
Nova (vms), Cinder (volumes), Cinder-backups (backups), and Glance (images).
Expand Down Expand Up @@ -169,7 +179,7 @@ cifmw_cephadm_keys:
mode: '0600'
caps:
mgr: allow *
mon: profile rbd
mon: allow r, profile rbd
osd: profile rbd pool=vms, profile rbd pool=volumes, profile rbd pool=backups, profile rbd pool=images
```

Expand Down
6 changes: 6 additions & 0 deletions scenarios/centos-9/hci_ceph_backends.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,12 @@ cifmw_cephadm_version: "tentacle"
cifmw_cephadm_prepare_host: true
# Apply the new spec version for RGW/TLS
cifmw_rgw_ssl_backward_compatibility: false
# CVE-2025-30156: Tentacle daemons may use aes256k, but Antelope
# Glance/Cinder/Manila librados only understands aes. Allow both
# types and mint client.openstack as aes. Do not set
# auth_preferred_cipher until those service images are upgraded.
cifmw_ceph_key_cipher: aes
cifmw_cephadm_auth_allowed_ciphers: "aes,aes256k"

cifmw_install_yamls_vars:
BMO_SETUP: false
Expand Down
Loading