Hi Patrick, Patrick Donnelly wrote:
On Thu, Aug 20, 2026 at 10:54 AM Jan Kasprzak <ceph-users@ceph.io> wrote:
ceph --format=json health detail | jq '.checks | has("AUTH_INSECURE_SERVICE_KEY_TYPE") | not' output gives false.
I might have done something wrong, but if I remember it correctly, at this point I still got 4 AUTH_INSECURE_SERVICE_KEY_TYPE keys, and had to do step 5 "ceph mon set auth_service_cipher aes256k" first and then step 6 "ceph auth wipe-rotating-service-keys". Only then the AUTH_INSECURE_SERVICE_KEY_TYPE disappeared from ceph health detail (together with AUTH_INSECURE_ROTATING_SERVICE_KEY_TYPE).
AUTH_INSECURE_SERVICE_KEY_TYPE indicates that the service, e.g. osd.0, is using an aes key to authenticate with the Monitors. That can only be addressed by rotating that service's key.
The other health error is AUTH_INSECURE_ROTATING_SERVICE_KEY_TYPE which is addressed by the auth_service_cipher monitor setting (required) and wiping the rotating key database (optional).
I will try it on another cluster, but I really think I had the AUTH_INSECURE_SERVICE_KEY_TYPE with all my keys already replaced.
One question, though: is it possible to have a client with two keys, aes and aes256? One of my cluster is mainly used for RBD with client.libvirt user, and I have hundreds of running VMs, which I cannot restart at once. So I would like to _add_ an aes256 key to the client.libvirt user, and incrementally restart the qemu processes which use this secret.
No, you cannot have two keys. I think a lesson (for everyone) here is that each node should have its own client key. It became prevalent to use the same key everywhere for simplicity but it makes deployments and updates more challenging.
Or what is the recommended way of gradually replacing a client key?
Create new keys for each node.
Ah, interesting approach, thanks. I use OpenNebula on top of Ceph for VM management, and it has only one global Ceph username parameter for a given datastore, so I cannot do this. Regards, -Yenya -- | Jan "Yenya" Kasprzak <kas at {fi.muni.cz - work | yenya.net - private}> | | https://www.fi.muni.cz/~kas/ GPG: 4096R/A45477D5 | I don't like Python; its lack of inline, anonymous, multi-statement functions makes me sad. --Eric Wastl