Editing Ceph-CSI Provisioner for Kubernetes (section)

==== CVE-2021-20288 ====

A recent CVE on Ceph was published -- it affects Nautilus, Octopus, and Pacific:

 https://docs.ceph.com/en/latest/security/CVE-2021-20288/

I'm not sure about the risk in a closed environment, but since the alerts in the newest versions of ceph are annoying if you don't set the parameters to prevent it, I did so when I upgraded.  The problem is, ceph-csi uses the insecure way of reclaiming global_id that the parameter changes block.  So ... after 2 days of playing with it (and failing) on two different kubernetes clusters, I finally found enough in the logfiles to lead me to conclude that ceph-csi was doing it wrong.  I un-did the config changes to prevent it ... and it finally worked.  Not good, but at least I'm not crazy.

I put in an [https://github.com/ceph/ceph-csi/issues/2063 issue] on it ... let's see what they say.

Update:  it has been fixed (previously -- I just didn't find it when searching).  using v3.3.1 of their containers takes care of it.  I will say that their documentation hadn't been updated yet to reflect that the newer version had been fixed ... and since they're using a quay registry, it's not possible to see what versions of their containers are available :-(