Cephx Key Migration Procedure and Ceph 19.2 Squid Going EOL Soon

[wursti]

it says the following:

root@hv2:~# /usr/share/pve-manager/migrations/pve-cephx-rotate-service-keys
INFO: This is a dry run. No Ceph key, cipher setting, or daemon will be changed. Session observations can update the migration journal.
PASS: Every service key uses 'aes256k', and so do the service tickets.

Client keys awaiting action:
  'client.admin': 81 session(s) still authenticate with a previous key (hv1: 18, hv2: 20, hv3:
    24, hv4: 19). Both keys remain valid. Refresh these consumers, then rerun without options.
Possible consumers (host-wide hints, not session attribution):
Kernel hints mean sockets without an owning process.
  hv1: VM 100, VM 102, VM 106, VM 107, VM 113, VM 114, VM 115, VM 121, 3 more VMs; unattributed socket (possible kernel client)
  hv2: VM 108, VM 117, VM 120, VM 123, VM 143, VM 144, VM 145, VM 148, 5 more VMs; unattributed socket (possible kernel client)
  hv3: VM 101, VM 103, VM 104, VM 105, VM 116, VM 118, VM 122, VM 124, 7 more VMs; unattributed socket (possible kernel client)
  hv4: VM 129, VM 131, VM 133, VM 135, VM 137, VM 139, VM 140, VM 142, 2 more VMs; unattributed socket (possible kernel client)

 

[SteveITS]

@wursti
Is your PVE up to date on all nodes?

"add --verbose for fullnode, keyring, and device inventories"

I do not see where you ran the "rotate-admin-key" step?

 

[wursti]

@SteveITS
- Install is up to date: PVE 9.2.20 / Linux 7.0.14-17-pve
- "add --verbose" --> I do not understand
- I ran "--rotate-admin-key --apply"

After reading the manual once again, I sopped-started/live-migrated all VMs, then I rebooted all HVs.
Now it shows me something different:

root@hv1|~# /usr/share/pve-manager/migrations/pve-cephx-rotate-service-keys
INFO: This is a dry run. No Ceph key, cipher setting, or daemon will be changed. Session observations can update the migration journal.
PASS: Every service key uses 'aes256k', and so do the service tickets.

Ready for confirmation: client.admin
Confirm only after refreshing every consumer, including disconnected ones and external key copies:
  /usr/share/pve-manager/migrations/pve-cephx-rotate-service-keys --apply --confirm-all-clients-refreshed --restrict-ciphers

root@hv1|~# /usr/share/pve-manager/migrations/pve-cephx-rotate-service-keys --apply --confirm-all-clients-refreshed  --restrict-ciphers
INFO: Recovery and confirmations may run before the remaining plan can be shown.

Apply this run, including recovery and any requested key confirmations? (y/N) y
INFO: Collecting cluster info.
WARN: accepting '--confirm-all-clients-refreshed' for client.admin: every consumer of them that this run can see is refreshed, and you confirm the same for those it cannot see
INFO: committing the staged key of 'client.admin', its previous key stops working now
PASS: 'client.admin' now uses the 'aes256k' cipher
INFO: Nothing in this plan is stopped, so the cluster health does not gate this run.

Plan
Step 1: allow only the 'aes256k' cipher for authentication, which clears the remaining insecure-key warnings. A key or client on the old cipher is refused from then on. This causes brief monitor elections.
FAIL: refusing to restrict the allowed ciphers: not every monitor answered the session query, so live consumers cannot be verified. Run this without options to check the remaining steps.

Ok, looks were getting closer:
"not every monitor answered the session query"

The rest looks good so far...

 

[SteveITS]

- "add --verbose" --> I do not understand

Sorry, I answered quickly...I quoted the doc page which says --verbose is an option. Maybe it will show more info.

Are you doing this as root?