Rebase cephcsi image to el10

[shatadru]

Describe the feature you'd like to have

Rebase the Ceph-CSI container image from CentOS Stream 9 (el9) to Rocky
Linux 10 (el10). Ceph's own daemon image already defaults to Rocky Linux 10
for Tentacle.

To be specific in deploy/cephcsi/image/Dockerfile :

• move the builder and final stages to an el10 base (Rocky Linux 10 /
  rockylinux:10 / rockylinux:10-minimal), and
• switch the ceph-release / client-package URLs from rpm-/el9 to
  rpm-/el10.

ceph/ceph already defaulting to el10 now
ceph/ceph#67959, tracker
https://tracker.ceph.com/issues/75673).

What new functionality do you want?

What is the value to the end user? (why is it a priority?)

How would the end user gain value from having this feature?

• The CentOS Stream 9 stream image has a huge backlog of CVEs refer Security Vulnerabilities #6215

• CentOS Stream 9 publishes no per-CVE "fixed-in" errata feed, so security
  scanners cannot resolve fixed-state and report many false positives against
  this image. Rocky Linux 10 publishes errata (errata.rockylinux.org), which
  lets scanners resolve those, reducing false-positive noise for every
  downstream consumer that scans the Ceph-CSI image.

• el10 rebases OS packages (openssl, python3, glib2, libxml2, expat, krb5,
  etc.) to substantially newer upstream versions, reducing the real CVE
  backlog carried by the image.

• CentOS Stream 9 reaches EOL in May 2027; Rocky Linux 10 is supported far
  longer, aligning the CSI image with Ceph's own supported container base.

How will we know we have a good solution? (acceptance criteria)

• deploy/cephcsi/image/Dockerfile builds successfully on el10 for both
  linux/amd64 and linux/arm64. Released Tentacle el10 Ceph RPMs
  (20.2.2-0.el10) already exist for x86_64 and aarch64.
• The cephcsi binary is compiled against el10 client -devel libraries (not an
  el9 binary run on el10 libraries). ldd /usr/local/bin/cephcsi shows no
  missing libraries and cephcsi --version succeeds.
• Existing e2e / CI image jobs pass unchanged.

Add a list of criteria that should be met for this feature to be useful

Additional context

• Released Tentacle el10 client and -devel RPMs are published at
  download.ceph.com/rpm-tentacle/el10/ for x86_64 and aarch64.

Related issues

Directly addressed by this proposal:

• Security Vulnerabilities #6215 "Security Vulnerabilities" (open, labels: security, dependency/ceph,
  component/build) - lists CVEs in cephcsi:v3.16.2, almost all in .el9
  packages (e.g. python3.9-3.9.25-4.el9, libarchive-3.5.3-6.el9,
  thrift-0.15.0-4.el9, gnupg2, openssh, protobuf, plus the dashboard/mgr
  Python stack). The el9 -> el10 rebase directly updates these package
  versions, and the already-merged minimal final base removes the daemon /
  dashboard packages (flask, werkzeug, jinja2, oauthlib, samba, oath-toolkit,
  etc.) that account for a large share of that list.

[shatadru]

I have locally tested building on el10

• it significantly reduces the bloat of the cephcsi image from 2G to 556 MiB, rpm reduced from 220 from 457.
• ceph-common / librados2 20.2.2-0.el10 from 20.2.1-0.el9

[nixpanic]

Thanks @shatadru , do you want to provide a PR for this? Please see the developer guide for instructions.

[shatadru]

Sure, I would open a PR, thanks @nixpanic