Hi, those are all client keyrings, cephadm doesn't touch them. It would have to assume which keyrings for which clients are safe to rotate which could be potentially dangerous, so I assume that's why it skips them entirely. Zitat von Robert Sander <ceph-users@ceph.io>:
Hi,
Am 02.11.26 um 4:09 PM schrieb Julien Laurenceau:
Yes there are operation that you have to do by yourself. The upgrade only rotate the mon keys automatically.
I tried to clarify this on this post : https://pepitedata.com/ceph- tentacle-squid-security-release/
Where you'll find some code snippet to help like:
This only covers OSDs which are handled automatically by cephadm.
Why is there no automatic key rotation for RGW, NFS, crash, ceph-exporter and other services managed by cephadm?
I now have to deal with this list manually?
[WRN] AUTH_INSECURE_CLIENT_KEY_TYPE: 51 auth client entities with insecure key types entity client.admin using insecure key type: aes entity client.bootstrap-mds using insecure key type: aes entity client.bootstrap-mgr using insecure key type: aes entity client.bootstrap-osd using insecure key type: aes entity client.bootstrap-rbd using insecure key type: aes entity client.bootstrap-rbd-mirror using insecure key type: aes entity client.bootstrap-rgw using insecure key type: aes entity client.ceph-exporter.test-cephadm using insecure key type: aes entity client.ceph-exporter.test-mds01 using insecure key type: aes entity client.ceph-exporter.test-mds02 using insecure key type: aes entity client.ceph-exporter.test-mds03 using insecure key type: aes entity client.ceph-exporter.test-mon01 using insecure key type: aes entity client.ceph-exporter.test-mon02 using insecure key type: aes entity client.ceph-exporter.test-mon03 using insecure key type: aes entity client.ceph-exporter.test-osd01 using insecure key type: aes entity client.ceph-exporter.test-osd02 using insecure key type: aes entity client.ceph-exporter.test-osd03 using insecure key type: aes entity client.ceph-exporter.test-osd04 using insecure key type: aes entity client.ceph-exporter.test-osd05 using insecure key type: aes entity client.ceph-exporter.test-osd06 using insecure key type: aes entity client.ceph-exporter.test-osd07 using insecure key type: aes entity client.ceph-exporter.test-osd08 using insecure key type: aes entity client.ceph-exporter.test-osd09 using insecure key type: aes entity client.crash.test-cephadm using insecure key type: aes entity client.crash.test-mds01 using insecure key type: aes entity client.crash.test-mds02 using insecure key type: aes entity client.crash.test-mds03 using insecure key type: aes entity client.crash.test-mon01 using insecure key type: aes entity client.crash.test-mon02 using insecure key type: aes entity client.crash.test-mon03 using insecure key type: aes entity client.crash.test-osd01 using insecure key type: aes entity client.crash.test-osd02 using insecure key type: aes entity client.crash.test-osd03 using insecure key type: aes entity client.crash.test-osd04 using insecure key type: aes entity client.crash.test-osd05 using insecure key type: aes entity client.crash.test-osd06 using insecure key type: aes entity client.crash.test-osd07 using insecure key type: aes entity client.crash.test-osd08 using insecure key type: aes entity client.crash.test-osd09 using insecure key type: aes entity client.nfs.nfs01.0.4.test-mon02.wgitjt using insecure key type: aes entity client.nfs.nfs01.0.4.test-mon02.wgitjt-rgw using insecure key type: aes entity client.nfs.nfs01.1.7.test-mon01.fvhlxu using insecure key type: aes entity client.nfs.nfs01.1.7.test-mon01.fvhlxu-rgw using insecure key type: aes entity client.nfs.nfs01.2.0.test-mon03.ydsjfi using insecure key type: aes entity client.nfs.nfs01.2.0.test-mon03.ydsjfi-rgw using insecure key type: aes entity client.nfs.nfs01.test.8d14d02e using insecure key type: aes entity client.rgw.test.test-mds01.wgifhi using insecure key type: aes entity client.rgw.test.test-mds02.lebwqv using insecure key type: aes entity client.rgw.test.test-mds03.jzkseo using insecure key type: aes entity client.shares-test using insecure key type: aes entity client.shares-test-lock using insecure key type: aes
client.admin and the two client.shares* keys I understand, these are to be treated manually. But the rest could be rotated automatically IMHO.
Regards -- Robert Sander Linux Consultant
Heinlein Consulting GmbH Schwedter Str. 8/9b, 10119 Berlin
https://www.heinlein-support.de
Tel: +49 30 405051 - 0 Fax: +49 30 405051 - 19
Amtsgericht Berlin-Charlottenburg - HRB 220009 B Geschäftsführer: Peer Heinlein - Sitz: Berlin _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io