Hi, Am 02.11.26 um 4:23 PM schrieb Eugen Block:
those are all client keyrings, cephadm doesn't touch them. It would have to assume which keyrings for which clients are safe to rotate which could be potentially dangerous, so I assume that's why it skips them entirely.
IMHO this is not what a Ceph admin would expect. Cephadm manages these services. There is not even a documented way to rotate the keys for an NFS service manually for example. https://docs.ceph.com/en/latest/rados/configuration/auth-config-ref/#cephx-u... tells me that cephadm does everything except for client keys. But there is nothing in section 9 "Rotate other client keys" about the services managed by cephadm that use client keys. I assume I have to ceph auth rotate --key-type=aes256k client.crash.test-cephadm ceph orch daemon redeploy crash.test-cephadm for each of them? Why is this not implemented in the orchestrator? Regards -- Robert Sander Linux Consultant Heinlein Consulting GmbH Schwedter Str. 8/9b, 10119 Berlin https://www.heinlein-support.de Tel: +49 30 405051 - 0 Fax: +49 30 405051 - 19 Amtsgericht Berlin-Charlottenburg - HRB 220009 B Geschäftsführer: Peer Heinlein - Sitz: Berlin