Rotating Heads and CephX Keys
summary
CephX moves its default rotating-service cipher from AES‑128 to AES-256k, introduces an o rotate API to atomically update credentials, and migrates the monitor key into the OSD DB. Cluster operators must rotate mons, OSDs, mgrs, MDSs and then client keys (client.admin is critical), expect six new health warnings, and tolerate legacy clients that may abort until ciphers are loosened. Automation exists via Rook automated rotation and seadm for services; client-key rotation remains manual.
AI-written summary · about
chapters (7)
- 0:00Introduction to CephX
- 6:27Quantum safety concerns
- 8:55CephX key rotation overview
- 12:06Upgrade process for operators
- 20:58Health warnings during upgrade
- 23:03New cluster defaults and Rook
- 25:53Future improvements and Q&A
related talks
36mCeph Security BoF
35mData Security and Storage Hardening in Rook and Ceph
39mCeph in Scientific Computing and Large Clusters BoF
27mEncrypting Data in Ceph: An Overview and Opportunities
30mData Security: Theoretical and Real World Approache...
18mData Security and Storage Hardening in Rook and Ceph
33mBringing fscrypt Encryption to CephFS Userspace
30mLong Live Short Lived Credentials - Auto-rotating Secrets At Scale