Hi, what I noted in my "best practices" doc is this article from RH how to convert to json format: https://access.redhat.com/solutions/7109138 And after conversion the certificate and key are imported like this: ceph config-key set mgr/cephadm/cert_store.cert.grafana_cert -i grafana_certs.json ceph config-key set mgr/cephadm/cert_store.cert.grafana_key -i grafana_key.json I vaguely remember a thread here on this list about it as well, but I don't know if this workaround is still required or not. I'll probably have to when the current cert expires. :-D Regards, Eugen Zitat von Robert Sander via ceph-users <ceph-users@ceph.io>:
Hi,
how do I set the grafana certificate and key in Ceph 19 that is used on port 3000?
The documentation on https://docs.ceph.com/en/squid/cephadm/services/monitoring/#configuring-ssl-... states:
# ceph config-key set mgr/cephadm/{hostname}/grafana_key -i $PWD/key.pem # ceph config-key set mgr/cephadm/{hostname}/grafana_crt -i $PWD/certificate.pem # ceph orch reconfig grafana
But after doing that grafana still serves a self-signed certificate with the common name containing the hostname of the first MON (which is not correct).
Digging into "ceph config-key dump" shows two entries named mgr/cephadm/cert_store.cert.grafana_cert and mgr/cephadm/cert_store.key.grafana_key which seem to cause this.
AFAIK the certmgr is only available in Ceph 20. But the docs for this version look the same: https://docs.ceph.com/en/tentacle/cephadm/services/monitoring/#configuring-s...
Only the docs for Ceph 21 got an update and mention certmgr: https://docs.ceph.com/en/umbrella/cephadm/services/monitoring/#configuring-s...
The orchestrator in Ceph 19 seems to have something called cert-store:
# ceph orch cert-store no valid command found; 4 closest matches: orch cert-store cert ls [--format {plain|json|json-pretty|yaml|xml-pretty|xml}] orch cert-store key ls [--format {plain|json|json-pretty|yaml|xml-pretty|xml}] orch cert-store get cert <entity> [--service_name <value>] [--hostname <value>] [--no-exception-when-missing] orch cert-store get key <entity> [--service_name <value>] [--hostname <value>] [--no-exception-when-missing] Error EINVAL: invalid command
But there is no help available. "ceph orch cert-store --help" does not return anything specific. Searching for "cert-store" in the Ceph 19 docs also does not return anything.
Regards -- Robert Sander Linux Consultant
Heinlein Consulting GmbH Schwedter Str. 8/9b, 10119 Berlin
https://www.heinlein-support.de
Tel: +49 30 405051 - 0 Fax: +49 30 405051 - 19
Amtsgericht Berlin-Charlottenburg - HRB 220009 B Geschäftsführer: Peer Heinlein - Sitz: Berlin _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io