mon/AuthMonitor: provide command to rotate the key for a user credential by batrick · Pull Request #58121 · ceph/ceph

batrick · 2024-06-18T18:42:57Z

Contribution Guidelines

To sign and title your commits, please refer to Submitting Patches to Ceph.
If you are submitting a fix for a stable branch (e.g. "quincy"), please refer to Submitting Patches to Ceph - Backports for the proper workflow.
When filling out the below checklist, you may click boxes directly in the GitHub web UI. When entering or editing the entire PR message in the GitHub web UI editor, you may also select a checklist item by adding an x between the brackets: [x]. Spaces and capitalization matter when checking off items this way.

Checklist

Tracker (select at least one)
- References tracker ticket
- Very recent bug; references commit where it was introduced
- New feature (ticket optional)
- Doc update (no ticket needed)
- Code cleanup (no ticket needed)
Component impact
- Affects Dashboard, opened tracker ticket
- Affects Orchestrator, opened tracker ticket
- No impact that needs to be tracked
Documentation (select at least one)
- Updates relevant documentation
- No doc update is appropriate
Tests (select at least one)
- Includes unit test(s)
- Includes integration test(s)
- Includes bug reproducer
- No tests

Show available Jenkins commands

jenkins retest this please
jenkins test classic perf
jenkins test crimson perf
jenkins test signed
jenkins test make check
jenkins test make check arm64
jenkins test submodules
jenkins test dashboard
jenkins test dashboard cephadm
jenkins test api
jenkins test docs
jenkins render docs
jenkins test ceph-volume all
jenkins test ceph-volume tox
jenkins test windows
jenkins test rook e2e

doc/rados/operations/user-management.rst

batrick · 2024-06-19T15:57:56Z

jenkins test make check

batrick · 2024-06-19T15:58:02Z

jenkins test api

batrick · 2024-06-20T12:33:40Z

jenkins test make check

rzarzynski · 2024-06-20T21:13:41Z

qa/workunits/cephtool/test.sh

+  ceph auth get-or-create client.admin2 mon 'allow *'
+  ceph auth get client.admin2 >> keyring1
+  env CEPH_KEYRING=keyring1 ceph -n client.admin2 auth get client.admin2 >> keyring2
+  diff -au keyring1 keyring2


rzarzynski · 2024-06-20T21:14:12Z

qa/workunits/cephtool/test.sh

+  diff -au keyring1 keyring2
+  # rotate itself
+  env CEPH_KEYRING=keyring1 ceph -n client.admin2 auth rotate client.admin2 >> keyring3
+  expect_false diff -au keyring1 keyring3


Yeah, secret should be different...

rzarzynski · 2024-06-20T21:15:07Z

qa/workunits/cephtool/test.sh

+  # rotate itself
+  env CEPH_KEYRING=keyring1 ceph -n client.admin2 auth rotate client.admin2 >> keyring3
+  expect_false diff -au keyring1 keyring3
+  expect_false env CEPH_KEYRING=keyring1 ceph -n client.admin2 auth get client.admin2


... so we shouldn't be able to operate using the old one.

rzarzynski · 2024-06-20T21:16:58Z

qa/workunits/cephtool/test.sh

+  expect_true env CEPH_KEYRING=keyring3 ceph -n client.admin2 auth get client.admin2
+  expect_true ceph auth get client.admin2 >> keyring4
+  expect_true diff -au keyring3 keyring4
+  rm keyring[1234]


I would love to see a check ensuring the only thing that got changed is the secret itself; particularly that the caps are untouched.

diff --git a/qa/workunits/cephtool/test.sh b/qa/workunits/cephtool/test.sh index d024ce6912d4..266f133c6037 100755 --- a/qa/workunits/cephtool/test.sh +++ b/qa/workunits/cephtool/test.sh @@ -613,14 +613,20 @@ function test_auth() ceph auth get-or-create client.admin2 mon 'allow *' ceph auth get client.admin2 >> keyring1 env CEPH_KEYRING=keyring1 ceph -n client.admin2 auth get client.admin2 >> keyring2 - diff -au keyring1 keyring2 + # they are the same: + expect_true diff -au keyring1 keyring2 # rotate itself env CEPH_KEYRING=keyring1 ceph -n client.admin2 auth rotate client.admin2 >> keyring3 - expect_false diff -au keyring1 keyring3 + # only the key has changed: + diff -au keyring1 keyring3 | grep -E '^[-+][^-+]' | expect_false grep -v key + # the key in keyring1 no longer works: expect_false env CEPH_KEYRING=keyring1 ceph -n client.admin2 auth get client.admin2 + # the key in keyring3 should work: expect_true env CEPH_KEYRING=keyring3 ceph -n client.admin2 auth get client.admin2 + # now verify the key from `auth get` matches what rotate produced: expect_true ceph auth get client.admin2 >> keyring4 expect_true diff -au keyring3 keyring4 + expect_true ceph auth rm client.admin2 rm keyring[1234] # (almost) interactive mode

👍 Thank you!

Add command to rotate the permanent key of an entity. This avoids the need to delete / recreate the key when it is compromised, lost, or just scheduled for rotation. Fixes: https://tracker.ceph.com/issues/66509 Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>

Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>

rzarzynski · 2024-06-22T11:19:45Z

qa/workunits/cephtool/test.sh

+  expect_true env CEPH_KEYRING=keyring3 ceph -n client.admin2 auth get client.admin2
+  expect_true ceph auth get client.admin2 >> keyring4
+  expect_true diff -au keyring3 keyring4
+  rm keyring[1234]


👍 Thank you!

batrick · 2024-06-22T14:50:26Z

This PR is under test in https://tracker.ceph.com/issues/66609.

batrick · 2024-06-23T18:28:12Z

https://tracker.ceph.com/issues/66609#note-1

Ceph has a new ceph auth rotate command currently present in ceph:main. More: ceph/ceph#58121 Add a cephclient api support to rotate the cephx keys genrated by cephclient Signed-off-by: parth-gr <partharora1010@gmail.com>

Ceph has a new ceph auth rotate command currently present in ceph:main. More: ceph/ceph#58121 Add a new flag `--cephx-key-rotation` to rotate the cephx keys genrated by external python script, If we enable it new ceph user wil be created with `-rotated` added to the suffix Signed-off-by: parth-gr <partharora1010@gmail.com>

batrick requested review from a team as code owners June 18, 2024 18:42

github-actions bot added core documentation mon tests labels Jun 18, 2024

batrick requested a review from rzarzynski June 18, 2024 18:43

anthonyeleven reviewed Jun 18, 2024

View reviewed changes

doc/rados/operations/user-management.rst Outdated Show resolved Hide resolved

batrick force-pushed the i66509 branch 2 times, most recently from 6a4ef0e to be4b9ef Compare June 18, 2024 19:39

batrick added wip-pdonnell-testing needs-review labels Jun 20, 2024

rzarzynski reviewed Jun 20, 2024

View reviewed changes

batrick added 4 commits June 20, 2024 21:31

qa: test auth rotate

2ae027f

Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>

PendingReleaseNotes: add note for new auth rotate

deab044

Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>

doc: add documentation for ceph auth rotate

b871bbe

Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>

batrick force-pushed the i66509 branch from be4b9ef to b871bbe Compare June 21, 2024 01:31

rzarzynski approved these changes Jun 22, 2024

View reviewed changes

rzarzynski added needs-qa and removed needs-review labels Jun 22, 2024

batrick merged commit 0efe88d into ceph:main Jun 23, 2024

batrick deleted the i66509 branch June 23, 2024 18:32

This was referenced Jun 24, 2024

squid: mon/AuthMonitor: provide command to rotate the key for a user credential #58235

Merged

reef: mon/AuthMonitor: provide command to rotate the key for a user credential #58236

Merged

BlaineEXE mentioned this pull request May 1, 2025

object: automate RGW cephx key rotation rook/rook#15813

Merged

6 tasks

parth-gr mentioned this pull request Jun 26, 2025

core: automate cephclient cephx key rotation rook/rook#16060

Merged

6 tasks

parth-gr mentioned this pull request Jul 9, 2025

external: automate external users cephx key rotation rook/rook#16110

Merged

6 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

mon/AuthMonitor: provide command to rotate the key for a user credential#58121

mon/AuthMonitor: provide command to rotate the key for a user credential#58121
batrick merged 4 commits intoceph:mainfrom
batrick:i66509

batrick commented Jun 18, 2024 •

edited

Loading

Uh oh!

Uh oh!

batrick commented Jun 19, 2024

Uh oh!

batrick commented Jun 19, 2024

Uh oh!

batrick commented Jun 20, 2024

Uh oh!

rzarzynski Jun 20, 2024

Uh oh!

rzarzynski Jun 20, 2024

Uh oh!

rzarzynski Jun 20, 2024

Uh oh!

rzarzynski Jun 20, 2024

Uh oh!

batrick Jun 21, 2024

Uh oh!

rzarzynski Jun 22, 2024

Uh oh!

rzarzynski Jun 22, 2024

Uh oh!

batrick commented Jun 22, 2024

Uh oh!

batrick commented Jun 23, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

batrick commented Jun 18, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Contribution Guidelines

Checklist

Uh oh!

Uh oh!

batrick commented Jun 19, 2024

Uh oh!

batrick commented Jun 19, 2024

Uh oh!

batrick commented Jun 20, 2024

Uh oh!

rzarzynski Jun 20, 2024

Choose a reason for hiding this comment

Uh oh!

rzarzynski Jun 20, 2024

Choose a reason for hiding this comment

Uh oh!

rzarzynski Jun 20, 2024

Choose a reason for hiding this comment

Uh oh!

rzarzynski Jun 20, 2024

Choose a reason for hiding this comment

Uh oh!

batrick Jun 21, 2024

Choose a reason for hiding this comment

Uh oh!

rzarzynski Jun 22, 2024

Choose a reason for hiding this comment

Uh oh!

rzarzynski Jun 22, 2024

Choose a reason for hiding this comment

Uh oh!

batrick commented Jun 22, 2024

Uh oh!

batrick commented Jun 23, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

batrick commented Jun 18, 2024 •

edited

Loading