Hi, Am 02.11.26 um 4:09 PM schrieb Julien Laurenceau:
Yes there are operation that you have to do by yourself. The upgrade only rotate the mon keys automatically.
I tried to clarify this on this post : https://pepitedata.com/ceph- tentacle-squid-security-release/
Where you'll find some code snippet to help like:
This only covers OSDs which are handled automatically by cephadm. Why is there no automatic key rotation for RGW, NFS, crash, ceph-exporter and other services managed by cephadm? I now have to deal with this list manually? [WRN] AUTH_INSECURE_CLIENT_KEY_TYPE: 51 auth client entities with insecure key types entity client.admin using insecure key type: aes entity client.bootstrap-mds using insecure key type: aes entity client.bootstrap-mgr using insecure key type: aes entity client.bootstrap-osd using insecure key type: aes entity client.bootstrap-rbd using insecure key type: aes entity client.bootstrap-rbd-mirror using insecure key type: aes entity client.bootstrap-rgw using insecure key type: aes entity client.ceph-exporter.test-cephadm using insecure key type: aes entity client.ceph-exporter.test-mds01 using insecure key type: aes entity client.ceph-exporter.test-mds02 using insecure key type: aes entity client.ceph-exporter.test-mds03 using insecure key type: aes entity client.ceph-exporter.test-mon01 using insecure key type: aes entity client.ceph-exporter.test-mon02 using insecure key type: aes entity client.ceph-exporter.test-mon03 using insecure key type: aes entity client.ceph-exporter.test-osd01 using insecure key type: aes entity client.ceph-exporter.test-osd02 using insecure key type: aes entity client.ceph-exporter.test-osd03 using insecure key type: aes entity client.ceph-exporter.test-osd04 using insecure key type: aes entity client.ceph-exporter.test-osd05 using insecure key type: aes entity client.ceph-exporter.test-osd06 using insecure key type: aes entity client.ceph-exporter.test-osd07 using insecure key type: aes entity client.ceph-exporter.test-osd08 using insecure key type: aes entity client.ceph-exporter.test-osd09 using insecure key type: aes entity client.crash.test-cephadm using insecure key type: aes entity client.crash.test-mds01 using insecure key type: aes entity client.crash.test-mds02 using insecure key type: aes entity client.crash.test-mds03 using insecure key type: aes entity client.crash.test-mon01 using insecure key type: aes entity client.crash.test-mon02 using insecure key type: aes entity client.crash.test-mon03 using insecure key type: aes entity client.crash.test-osd01 using insecure key type: aes entity client.crash.test-osd02 using insecure key type: aes entity client.crash.test-osd03 using insecure key type: aes entity client.crash.test-osd04 using insecure key type: aes entity client.crash.test-osd05 using insecure key type: aes entity client.crash.test-osd06 using insecure key type: aes entity client.crash.test-osd07 using insecure key type: aes entity client.crash.test-osd08 using insecure key type: aes entity client.crash.test-osd09 using insecure key type: aes entity client.nfs.nfs01.0.4.test-mon02.wgitjt using insecure key type: aes entity client.nfs.nfs01.0.4.test-mon02.wgitjt-rgw using insecure key type: aes entity client.nfs.nfs01.1.7.test-mon01.fvhlxu using insecure key type: aes entity client.nfs.nfs01.1.7.test-mon01.fvhlxu-rgw using insecure key type: aes entity client.nfs.nfs01.2.0.test-mon03.ydsjfi using insecure key type: aes entity client.nfs.nfs01.2.0.test-mon03.ydsjfi-rgw using insecure key type: aes entity client.nfs.nfs01.test.8d14d02e using insecure key type: aes entity client.rgw.test.test-mds01.wgifhi using insecure key type: aes entity client.rgw.test.test-mds02.lebwqv using insecure key type: aes entity client.rgw.test.test-mds03.jzkseo using insecure key type: aes entity client.shares-test using insecure key type: aes entity client.shares-test-lock using insecure key type: aes client.admin and the two client.shares* keys I understand, these are to be treated manually. But the rest could be rotated automatically IMHO. Regards -- Robert Sander Linux Consultant Heinlein Consulting GmbH Schwedter Str. 8/9b, 10119 Berlin https://www.heinlein-support.de Tel: +49 30 405051 - 0 Fax: +49 30 405051 - 19 Amtsgericht Berlin-Charlottenburg - HRB 220009 B Geschäftsführer: Peer Heinlein - Sitz: Berlin