Do you have a keyring in /etc/pve/priv/ceph/<your_rbd_storage>.keyring?
If so, AND you still have
auth_client_required = none
auth_cluster_required = none
auth_service_required = none
set in your ceph.conf, try renaming that to...
I solved this for my cluster. The steps were thus:
Make sure all your monitor keyring files are identical (all mon use the same key!) and of this structure (use your real client-admin key)
[mon.]
key = <somekey>
caps mon =...
FWIW: If it were necessary to first re-enable cephx on the cluster to proceed with migration, steps on how to do that *safely* (and hopefully without downtime?) would be appreciated.