medium risksecurity relevant~45 min

Rotate a cephx key

1 · Prerequisites

Confirm every item is in place before any state change.

A rotation cadence is scheduled (quarterly is recommended)
The cluster is HEALTH_OK
The keyring is current

2 · Pre-checks

Read-only diagnostic commands. If any of these don't match expected output, stop and investigate further.

· ceph auth list shows the entity to rotate
· The new keyring distribution target is identified
· The application has been notified of the rotation
· A maintenance window is scheduled (if the application cannot take a key change live)

3 · Procedure

Execute each step in order. Verify the expected output of a step before moving to the next.

1Generate the new key: ceph auth get-or-create-key client.<user>
2Distribute the new keyring to the legitimate consumers
3Wait for the application to use the new key (or restart it)
4Confirm both keys are accepted: ceph auth export client.<user> > /tmp/old-keyring.bin
5Set the old key to expire (or remove): ceph auth rm client.<user> --old
6Verify the application continues to work after the old key is removed

4 · Verification

Confirm the procedure actually fixed the problem.

✓The new key is in use by the application
✓The old key is removed
✓The application continues to work
✓The rotation is documented

5 · Rollback

If verification fails, undo the procedure in reverse order.

↶If the application cannot use the new key: distribute the prior key back as a fallback
↶If the cluster breaks: investigate which consumer was using the old key
↶If the rotation cannot be verified: redo with a clear schedule

6 · Escalation

When the runbook isn't enough, contact:

· Security team
· Application team
· Storage team

Rotate a cephx key

This runbook covers Rotate a cephx key on a Ceph Tentacle cluster.

When to use

Active production scenario matching the impact (security-relevant)

Prerequisites

A rotation cadence is scheduled (quarterly is recommended)
The cluster is HEALTH_OK
The keyring is current

Pre-checks

# ceph auth list shows the entity to rotate
# The new keyring distribution target is identified
# The application has been notified of the rotation
# A maintenance window is scheduled (if the application cannot take a key change live)

Procedure

Step 1

Generate the new key: ceph auth get-or-create-key client.<user>

Step 2

Distribute the new keyring to the legitimate consumers

Step 3

Wait for the application to use the new key (or restart it)

Step 4

Confirm both keys are accepted: ceph auth export client.<user> > /tmp/old-keyring.bin

Step 5

Set the old key to expire (or remove): ceph auth rm client.<user> —old

Step 6

Verify the application continues to work after the old key is removed

Verification

# The new key is in use by the application
# The old key is removed
# The application continues to work
# The rotation is documented

Rollback

If the application cannot use the new key: distribute the prior key back as a fallback
If the cluster breaks: investigate which consumer was using the old key
If the rotation cannot be verified: redo with a clear schedule

Escalation

Security team
Application team
Storage team

References

Ceph documentation