Hi, can you share 'ceph mon dump |grep cipher'? If you use cephadm, the orchestrator should already have that done for you. The warning you're seeing will clear after a few hours automatically. If you don't use cephadm, you can safely set 'ceph mon set auth_service_cipher aes256k' because it really does only affect the core services, otherwise I'd have a problem. ;-) I upgraded our production (cephadm) cluster this week and all went well. We also can't upgrade our clients at this time, so we're all in the same boat, I guess. :-) Regards, Eugen Zitat von Christopher Durham <ceph-users@ceph.io>:

Hi: After update to 19.2.6 I am so far successfully updating key types for various daemons. I have the following messages in the output of 'ceph health detail':

[WRN] AUTH_INSECURE_ROTATING_SERVICE_KEY_TYPE: 4 rotating auth service keys using insecure key types     rotating service keys for mon using insecure key type: aes     rotating service keys for mds using insecure key type: aes     rotating service keys for osd using insecure key type: aes     rotating service keys for mgr using insecure key type: aes The doc says to set auth_service_cipher to aes256k. Before I change that, I have a question: Is this setting ONLY for mon/mds/osd/mgr?  I ask because i have several client keys that cannot be updated to aes256k yet, such as the keys for ceph-csi in kubernetes. I want to be sure that if  update auth_service_cipher to aes256k, I am ONLY affecting the rotating keys for mon/mds/osd/mgr. I do not want to set auth_service_cipher to aes256k and then have the ceph-csi still able to authenticate with older aes keys but not able to do rotating keys after authentication ( I do not know if it does ).. Thanks for any information -Chris

_______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io