Hello, On Thu, Aug 20, 2026 at 11:34 PM William Xiong <william.xiong@unimelb.edu.au> wrote:
Hi Patrick,
Regarding the fix for CVE-2025-30156
We've discovered that the bluestore label still contains the old key after following instructions at https://docs.ceph.com/en/latest/rados/configuration/auth-config-ref/index.ht...
Old key shows up as per: ceph-bluestore-tool show-label --dev "$(readlink -f /var/lib/ceph/osd/ceph-X/block)" | grep osd_key
If we reboot the osd servers, the new key is overwritten with the old key in /var/lib/ceph/osd/ceph-${OSD_ID}/keyring causing osd auth failure > osd service doesnt start Can simulate this without reboot via `umount /var/lib/ceph/osd/ceph-${OSD_ID}/` and reactivate via `ceph-volume lvm activate --all` We are running a non cephadm cluster.
Need to update the label as well after rotating the key: ceph-bluestore-tool set-label-key --dev "$(readlink -f /var/lib/ceph/osd/ceph-${OSD_ID}/block)" -k osd_key -v $NEW_KEY
Thanks, for the report. The documentation has been updated (step 3): https://docs.ceph.com/en/latest/rados/configuration/auth-config-ref/#upgradi... -- Patrick Donnelly, Ph.D. He / Him / His Red Hat Partner Engineer IBM, Inc. GPG: 19F28A586F808C2402351B93C3301A3E258DD79D