When using managed OSD the keys are not rotated automatically On 11/2/26 16:33, Julien Laurenceau wrote:
Yes, in my opinion, OSDs are the most difficult to rotate, whereas the other components can be rotated relatively easily.
It is also necessary to anticipate a period of user downtime for Kubernetes PVC creation, as this involves the RBD client keys used by the Ceph-CSI driver on a Kubernetes cluster.
On 11/2/26 16:20, Robert Sander wrote:
Hi,
Am 02.11.26 um 4:09 PM schrieb Julien Laurenceau:
Yes there are operation that you have to do by yourself. The upgrade only rotate the mon keys automatically I tried to clarify this on this post : https://pepitedata.com/ceph- tentacle-squid-security-release/
Where you'll find some code snippet to help like:
This only covers OSDs which are handled automatically by cephadm.
Why is there no automatic key rotation for RGW, NFS, crash, ceph-exporter and other services managed by cephadm?
I now have to deal with this list manually?
[WRN] AUTH_INSECURE_CLIENT_KEY_TYPE: 51 auth client entities with insecure key types entity client.admin using insecure key type: aes entity client.bootstrap-mds using insecure key type: aes entity client.bootstrap-mgr using insecure key type: aes entity client.bootstrap-osd using insecure key type: aes entity client.bootstrap-rbd using insecure key type: aes entity client.bootstrap-rbd-mirror using insecure key type: aes entity client.bootstrap-rgw using insecure key type: aes entity client.ceph-exporter.test-cephadm using insecure key type: aes entity client.ceph-exporter.test-mds01 using insecure key type: aes entity client.ceph-exporter.test-mds02 using insecure key type: aes entity client.ceph-exporter.test-mds03 using insecure key type: aes entity client.ceph-exporter.test-mon01 using insecure key type: aes entity client.ceph-exporter.test-mon02 using insecure key type: aes entity client.ceph-exporter.test-mon03 using insecure key type: aes entity client.ceph-exporter.test-osd01 using insecure key type: aes entity client.ceph-exporter.test-osd02 using insecure key type: aes entity client.ceph-exporter.test-osd03 using insecure key type: aes entity client.ceph-exporter.test-osd04 using insecure key type: aes entity client.ceph-exporter.test-osd05 using insecure key type: aes entity client.ceph-exporter.test-osd06 using insecure key type: aes entity client.ceph-exporter.test-osd07 using insecure key type: aes entity client.ceph-exporter.test-osd08 using insecure key type: aes entity client.ceph-exporter.test-osd09 using insecure key type: aes entity client.crash.test-cephadm using insecure key type: aes entity client.crash.test-mds01 using insecure key type: aes entity client.crash.test-mds02 using insecure key type: aes entity client.crash.test-mds03 using insecure key type: aes entity client.crash.test-mon01 using insecure key type: aes entity client.crash.test-mon02 using insecure key type: aes entity client.crash.test-mon03 using insecure key type: aes entity client.crash.test-osd01 using insecure key type: aes entity client.crash.test-osd02 using insecure key type: aes entity client.crash.test-osd03 using insecure key type: aes entity client.crash.test-osd04 using insecure key type: aes entity client.crash.test-osd05 using insecure key type: aes entity client.crash.test-osd06 using insecure key type: aes entity client.crash.test-osd07 using insecure key type: aes entity client.crash.test-osd08 using insecure key type: aes entity client.crash.test-osd09 using insecure key type: aes entity client.nfs.nfs01.0.4.test-mon02.wgitjt using insecure key type: aes entity client.nfs.nfs01.0.4.test-mon02.wgitjt-rgw using insecure key type: aes entity client.nfs.nfs01.1.7.test-mon01.fvhlxu using insecure key type: aes entity client.nfs.nfs01.1.7.test-mon01.fvhlxu-rgw using insecure key type: aes entity client.nfs.nfs01.2.0.test-mon03.ydsjfi using insecure key type: aes entity client.nfs.nfs01.2.0.test-mon03.ydsjfi-rgw using insecure key type: aes entity client.nfs.nfs01.test.8d14d02e using insecure key type: aes entity client.rgw.test.test-mds01.wgifhi using insecure key type: aes entity client.rgw.test.test-mds02.lebwqv using insecure key type: aes entity client.rgw.test.test-mds03.jzkseo using insecure key type: aes entity client.shares-test using insecure key type: aes entity client.shares-test-lock using insecure key type: aes
client.admin and the two client.shares* keys I understand, these are to be treated manually. But the rest could be rotated automatically IMHO.
Regards
ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io