Ceph Squid to Tentacle Migration

[RMaxwell72]

Hello, the guide overall was helpful, but ran into the same issue as another user where I had to increase the timeout in the helper script to be able to update the CephFS keys:

perl -0pi -e 's/(PVE::Tools::run_command\(\s*\[\x27umount\x27,\s*\$path\],\s*timeout\s*=>\s*)20/$1 65/' \
/usr/share/pve-manager/migrations/pve-cephx-rotate-service-keys

After that the storage keys and admin key was successful:

root@pve01:/etc/pve/priv/ceph# /usr/share/pve-manager/migrations/pve-cephx-rotate-service-keys     --rotate-all-storage-keys --rotate-admin-key --apply
INFO: Recovery and confirmations may run before the remaining plan can be shown.

Apply this run, including recovery and any requested key confirmations? (y/N) y
INFO: Collecting cluster info.
  redid the 'cephfs' mount on node 'pve01', which now reads the staged key
  redid the 'cephfs' mount on node 'pve02', which now reads the staged key
  redid the 'cephfs' mount on node 'pve03', which now reads the staged key
PASS: Every service key uses 'aes256k', and so do the service tickets.

Ready for confirmation: client.admin
Confirm only after refreshing every consumer, including disconnected ones and external key copies:
  /usr/share/pve-manager/migrations/pve-cephx-rotate-service-keys --apply --confirm-all-clients-refreshed --restrict-ciphers

One of the remaining steps though I'm receiving the following:

root@pve01:/etc/pve/priv/ceph# /usr/share/pve-manager/migrations/pve-cephx-rotate-service-keys --apply --confirm-all-clients-refreshed --restrict-ciphers
INFO: Recovery and confirmations may run before the remaining plan can be shown.

Apply this run, including recovery and any requested key confirmations? (y/N) y
INFO: Collecting cluster info.
WARN: accepting '--confirm-all-clients-refreshed' for client.admin: every consumer of them that this run can see is refreshed, and you confirm the same for those it cannot see
INFO: committing the staged key of 'client.admin', its previous key stops working now
FAIL: error with 'auth commit-pending': mon_cmd failed - creating key with insecure key type ("`preferred' AKA aes") not allowed

Any suggestions? Ceph's overall status shows:

root@pve03:/# ceph -s
  cluster:
    id:     354d9c2b-bdbf-49b5-aa66-46c841b39206
    health: HEALTH_WARN
            1 auth client entities with insecure key types
            Monitors are configured to allow auth using insecure key types
 
  services:
    mon: 3 daemons, quorum pve01,pve02,pve03 (age 15m) [leader: pve01]
    mgr: pve01(active, since 16m), standbys: pve02, pve03
    mds: 1/1 daemons up, 2 standby
    osd: 3 osds: 3 up (since 11m), 3 in (since 11w)
 
  data:
    volumes: 1/1 healthy
    pools:   4 pools, 169 pgs
    objects: 51.22k objects, 199 GiB
    usage:   587 GiB used, 844 GiB / 1.4 TiB avail
    pgs:     169 active+clean
 
  io:
    client:   2.7 KiB/s rd, 13 KiB/s wr, 0 op/s rd, 4 op/s wr