Hi, please read all the sections in the docs ;-) https://docs.ceph.com/en/latest/rados/configuration/auth-config-ref/index.ht... Although you use cephadm, step 6 is still relevant because it explains the warning you're seeing:
6. Wipe the rotating service keys. Warning This is not recommended for most deployments. It is best to let your rotating service keys expire after a few hours (using default TTL).
Warning Only perform this step if all service daemons have upgraded binaries that understand the new cipher type. If you want to immediately clear the AUTH_INSECURE_ROTATING_SERVICE_KEY_TYPE warning, you can wipe the existing rotating service key database on the Monitors:
This is just a transitional state, the warning will go away after a few hours (I'm not sure how long exactly). Regards, Eugen Zitat von Albert Shih <ceph-users@ceph.io>:
Hi everyone
So today I upgrade (one of) my ceph cluster (cephadm), and indeed after upgrading some time all osd come back to life and all osd key seem to be in aes256k
But still with ceph health detail I've got
[WRN] AUTH_INSECURE_ROTATING_SERVICE_KEY_TYPE: 4 rotating auth service keys using insecure key types rotating service keys for mon using insecure key type: aes rotating service keys for mds using insecure key type: aes rotating service keys for osd using insecure key type: aes rotating service keys for mgr using insecure key type: aes
When I look in the documentation
https://docs.ceph.com/en/latest/rados/configuration/auth-config-ref/#cephx-u...
section 3 it seem I had to copy the keyring directly to the nodes of my cluster who run those service, but inside
/var/lib/ceph/CEPHID/*
I didn't find any keyring file related to mon/mds/osd/mgr with aes key.
So I'm a little confuse...in the documentation it's say in a note:
The mon. historically has not been managed by the Monitor auth database; it exists soley in each Monitor’s keyring inside its data directory. This suggested rotation procedure now puts the authoritative copy in the auth database alongside other keys. The Monitor keyring persists as a fallback or emergency key.
so where are those rotation key ?
Regards
-- Albert SHIH 🦫 🐸 France Heure locale/Local time: jeu. 27 août 2026 11:50:08 CEST _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io