Purpose
Ceph’s default posture is better than its reputation - cephx is on out of the box - but the defaults stop at authentication. They do not stop an admin keyring being copied onto every client, a keyring being left world-readable, or the cluster network sharing a VLAN with everything else in the rack. This checklist is the review that separates the shipped defaults from the deployed ones.
Order of work
The list runs in four passes. The transport pass is cephx, ms-mode and
network: whether peers are authenticated, whether the wire is encrypted as
well as authenticated, and what else can reach that wire. The identity pass is
least-priv and admin, which are the two items with the most findings in
practice - the admin keyring spreads by copy-paste, and capability sets only
ever grow. The key-handling pass is keys and rotate: filesystem
permissions today, and a documented procedure for the day a key leaks. The
management-plane pass is mgmt-dashboard, which is the surface most likely to
be exposed further than anyone intended.
Before you start
Have the full auth list, the inventory of hosts holding a keyring, the VLAN the cluster network is on, and the dashboard’s current listen address and TLS configuration.
Verification
Ready when every critical item is checked and the auth list has been read directly from the cluster, not from configuration management. Mark an item N/A rather than leaving it unchecked when it does not apply to this cluster.
Escalation
A leaked or over-broad key is an incident. Follow the credential-compromise runbook rather than waiting for the next review cycle.