Controlling where `client.admin` exists

Why this matters in production

Every host holding the admin keyring is a host where compromise means full cluster control, plus — via the cephadm key — root on the fleet.

Inventorying the footprint

ceph orch host ls --format json | python3 -c '
import sys,json
for h in json.load(sys.stdin): print(h["hostname"])' | while read h; do
  printf '%-16s ' "$h"
  ssh "$h" 'ls -l /etc/ceph/ceph.client.admin.keyring 2>/dev/null || echo none'
done

# which hosts cephadm has labelled to receive it
ceph orch host ls --format json | python3 -c '
import sys,json
for h in json.load(sys.stdin):
    labs = h.get("labels", [])
    if "_admin" in labs: print("admin label:", h["hostname"])'

cephadm distributes the admin keyring to hosts carrying the _admin
label. Removing the label and the file is what reduces the footprint.

# Substitute the host you are removing admin from before running:
HOST=ceph-node-04

ceph orch host label rm "$HOST" _admin

# and remove the file, since removing the label does not delete it
# the same host as above
HOST=ceph-node-04

ssh "$HOST" 'rm -f /etc/ceph/ceph.client.admin.keyring'

Also check outside the cluster: workstations, CI runners, backup
scripts, and container images are where admin keyrings actually
accumulate.

Scoped alternatives for common tasks

ceph auth get-or-create client.readonly \
  mon 'allow r' osd 'allow r' mgr 'allow r'

ceph auth get-or-create client.monitoring \
  mon 'allow r' mgr 'allow r'

# use it explicitly
ceph -n client.readonly --keyring /etc/ceph/ceph.client.readonly.keyring -s

Most of what people use admin for is reading status. A read-only entity
covers it and removes the reason to have admin present.

Emergency access

The problem: reducing the footprint too far means nobody can act during
an incident.

# recreate the admin keyring from the cluster if it is lost
ceph auth get client.admin -o /etc/ceph/ceph.client.admin.keyring
# — which itself requires an entity able to read it

The recursion matters: recreating admin requires an entity with
sufficient capability. Keep at least one path that does not depend on
having admin already.

# the monitor's own keyring is that path, on a monitor host
# Substitute your own values before running — `ls /var/lib/ceph/` shows the
# fsid, and cephadm names the mon directory after the host's short name:
FSID=3f5b7e1a-9c24-4d8e-a1b6-27c0f9d4e5aa
MON_ID=ceph-node-01

ceph -n mon. -k "/var/lib/ceph/$FSID/mon.$MON_ID/keyring" auth get client.admin

Quiz

Production discipline

Create a read-only entity covering ceph -s, ceph df, and ceph osd tree before reducing the admin footprint — it removes the practical reason admin gets copied to workstations and CI runners. The monitor’s mon. keyring is the recovery path that makes removal safe.

Cross-course references

• Kubernetes: cluster-admin kubeconfig distribution is the analogous exposure
• Linux: providing the scoped alternative is what makes privilege reduction stick