Hi, I'm noticing that ceph does not have dual validity for keys. Is that correct? Because of this, I am thinking to use a blue green process to accomplish cephx key rotation. The caps of the existing client can be cloned with something like the below snippet, watch out for typos... And then clients can do rollout with new client+credentials with reduced impact. AUTH_OUT=$(ceph auth get "$SRC" 2>&1) || { echo “ERROR: 'ceph auth get $SRC' failed. Does the client exist?" >&2 exit 1 } CAP_ARGS=() while IFS= read -r line; do # Match: caps <daemon> = "<perms>" if [[ "$line" =~ ^[[:space:]]*caps[[:space:]]+([a-z]+)[[: space:]]*=[[:space:]]*\"(.*)\"[[:space:]]*$ ]]; then daemon="${BASH_REMATCH[1]}" perms="${BASH_REMATCH[2]}" CAP_ARGS+=("$daemon" “$perms” ) fi done <<< "“$AUTH_OUT" if [[ ${#CAP_ARGS[@]} -eq 0 ]]; then echo “ERROR: No caps found for $SRC. Refusing to create a client with no capabilities." >&2 exit 1 fi echo "Caps to apply to $NEW:" for (( i=0; i<${#CAP_ARGS[@]}; i+=2 )); do printf " %-6s = \"%s\"\n" "${CAP_ARGS[i]}" "${CAP_ARGS[i+1]}" done echo "" echo "Creating $NEW ..." ceph auth get-or-create "$NEW" "${CAP_ARGS[@]}" -o "$OUTFILE"