From 2abd946c05765b56b3b660c2daadfd908e6d2bb5 Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Fri, 21 Aug 2026 22:05:10 +0200 Subject: [PATCH] fix(rook-ceph): rotate CephX daemon keys to close CVE-2025-30156 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Ceph v19.2.6 ships the fix for CVE-2025-30156, a CephX authentication bypass: AES-128-CBC service tickets carry no HMAC and use a hard-coded IV, so a holder of any low-privilege key can bit-flip a ticket into cluster-admin in linear time. Upgrading the binaries does not resolve it — the keys themselves must be rotated to the aes256k cipher. The cluster is mid-procedure. auth_allowed_ciphers (aes, aes256k), auth_preferred_cipher (aes256k) and auth_service_cipher (aes256k) are already set, and the rotating service keys were wiped, but no actual key rotation has happened: every entity in status.cephx is still keyGeneration 1 with keyType aes, created under 19.2.3. Rook automates daemon-key rotation but it is opt-in and defaults to Disabled, so spec.security.cephx was left empty and nothing rotated. Rook v1.20.6 and Ceph v19.2.6 are both past the version floor the feature requires. Rotating daemon keys clears AUTH_INSECURE_SERVICE_KEY_TYPE, the only one of the six new checks at ERR severity. That is the operationally urgent part: Rook skips CephFS and RGW reconciliation entirely while health is HEALTH_ERR — which is what deadlocked the mds/rgw rollout in issue #527 — and the check is presently held down only by a mon-side mute with a finite TTL. When that mute lapses the cluster returns to HEALTH_ERR and the reconcile freeze comes back. CSI keys are deliberately left on aes. aes256k over the CSI mount path requires a host kernel of 7.0 or newer and these nodes run 6.18, so `aes` must stay in auth_allowed_ciphers for CSI to authenticate at all. AUTH_INSECURE_CLIENT_KEY_TYPE, AUTH_INSECURE_KEYS_ALLOWED and AUTH_INSECURE_KEYS_CREATABLE therefore stay raised at WARN until the nodes run a kernel that supports it. Rotation restarts most Ceph daemons. With size 2 pools across 3 OSDs this should be applied deliberately rather than alongside other churn, and Ceph should reach HEALTH_OK before anything else touches the cluster. Refs #527, #528 Co-Authored-By: Claude Opus 5 (1M context) --- .../rook-ceph-cluster/cephcluster.yaml | 27 +++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/kubernetes/infrastructure/rook-ceph-cluster/cephcluster.yaml b/kubernetes/infrastructure/rook-ceph-cluster/cephcluster.yaml index b59e9c97..d242c531 100644 --- a/kubernetes/infrastructure/rook-ceph-cluster/cephcluster.yaml +++ b/kubernetes/infrastructure/rook-ceph-cluster/cephcluster.yaml @@ -17,6 +17,33 @@ spec: modules: - name: pg_autoscaler enabled: true + # CVE-2025-30156: CephX AES-128-CBC service tickets carry no HMAC and use a + # hard-coded IV, so a holder of any low-privilege key can bit-flip a ticket + # into cluster-admin. The fix is rotating keys to the aes256k cipher — + # upgrading the binaries alone does not close it. Rotation is opt-in and + # defaults to Disabled, so it must be requested here. + # + # Daemon keys only. CSI keys stay on aes: aes256k over the CSI mount path + # needs a host kernel of 7.0 or newer and these nodes run 6.18. `aes` + # therefore has to remain in auth_allowed_ciphers for CSI to authenticate, + # which leaves AUTH_INSECURE_CLIENT_KEY_TYPE, AUTH_INSECURE_KEYS_ALLOWED and + # AUTH_INSECURE_KEYS_CREATABLE raised. Revisit once the nodes run a kernel + # that supports it. + # + # Rotating the daemon keys clears AUTH_INSECURE_SERVICE_KEY_TYPE, the only + # one of the six checks at ERR severity. That matters beyond the CVE itself: + # Rook skips CephFS and RGW reconciliation entirely while health is + # HEALTH_ERR, and that check is currently held down only by a mon-side mute + # with a finite TTL. + # + # keyType is deliberately unset — Rook picks the best type for daemon keys. + # To rotate again later, increment keyGeneration; Rook restarts the daemons + # to pick up the new keys. + security: + cephx: + daemon: + keyRotationPolicy: KeyGeneration + keyGeneration: 2 # Bump CephFS subvolume cloner pool from 4 → 16. Velero CSI Snapshot # Data Movement provisions a backupPVC per source PVC by cloning the # VolumeSnapshot, and a 4-thread default stalls migrate-immich's -- 2.54.0