Securing the cephadm SSH path

Why this matters in production

The cephadm SSH key grants privileged access to every host in the cluster from a single place, which makes it the broadest secret Ceph creates.

How cephadm authenticates

The active manager holds the private key.
Every managed host carries the corresponding public key in the
authorized_keys of the configured user.
cephadm connects as that user and escalates to run containers.

ceph cephadm get-pub-key
ceph cephadm get-user

# the private key, which lives in the config store
ceph config-key get mgr/cephadm/ssh_identity_key | head -1

It lives in the monitors' config-key store, replicated across the
quorum — not in a file on one host.

grep -c "$(ceph cephadm get-pub-key | awk '{print $2}')" \
  ~ceph/.ssh/authorized_keys 2>/dev/null || echo "check the configured user"

Protecting it

# restrict by source address in authorized_keys
# from="10.10.5.11,10.10.5.12" ssh-ed25519 AAAA... ceph-cephadm

The from= restriction limits the key to connections originating at the
manager hosts. It has to be updated when managers move, which is a real
operational cost — worth paying where the manager placement is fixed.

ceph orch ps --daemon-type mgr --format json | python3 -c '
import sys,json
for d in json.load(sys.stdin):
    print(d.get("hostname"), d.get("status_desc"))'

What the key can do

Whatever the configured user can do, which by default includes running
containers with device access — that is root-equivalent on the host.

ceph cephadm get-user

There is no configuration that makes this key non-privileged. cephadm
deploys daemons that need device access, so the access it requires is
inherently root-equivalent. The honest posture is to treat it as such
rather than to attempt to constrain it into something it cannot be.

Rotating it

# generate and distribute a new key
ceph cephadm generate-key
ceph cephadm get-pub-key > /tmp/ceph-new.pub

# distribute to every host, then verify
ceph orch host ls --format json | python3 -c '
import sys,json
for h in json.load(sys.stdin): print(h["hostname"])' | while read h; do
  ssh-copy-id -f -i /tmp/ceph-new.pub "$(ceph cephadm get-user)@$h"
done

ceph orch host ls
ceph orch ps --refresh | head

Verify orchestration works against every host before removing the old
public key from authorized_keys — a partially distributed new key leaves
hosts unmanageable.

ceph cephadm clear-key    # only after the new key is confirmed everywhere

Quiz

Production discipline

Treat client.admin as a path to root on every host, not merely control of Ceph — it can read the cephadm private key from the config-key store. When rotating that key, distribute the new one and verify orchestration against every host before removing the old.

Cross-course references

• Kubernetes: a node bootstrap credential grants what the kubelet can do, which is broad
• Linux: management-plane keys are privileged by function, not by configuration