From 5002f78e2da4e56f419c28d3477bd2f5549eabc9 Mon Sep 17 00:00:00 2001 From: Blaine Gardner Date: Tue, 24 Feb 2026 13:52:22 -0700 Subject: [PATCH] osd: update lockbox key rotation for encrypted OSDs Update `lockbox.keyring` rotation for encrypted OSDs to ensure the key is not lost if the init container fails but continues assuming (reasonably) that the key is likely still relevant. Signed-off-by: Blaine Gardner (cherry picked from commit 931006fb919766245d5803d7c308b92376b338da) --- pkg/operator/ceph/cluster/osd/spec.go | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pkg/operator/ceph/cluster/osd/spec.go b/pkg/operator/ceph/cluster/osd/spec.go index b5ffb98ed..18f170777 100644 --- a/pkg/operator/ceph/cluster/osd/spec.go +++ b/pkg/operator/ceph/cluster/osd/spec.go @@ -120,9 +120,12 @@ if [ "$ENCRYPTED" == "true" ] ; then if ! ceph --name client.admin auth get-or-create "$LOCKBOX_USER" \ mon 'allow command "config-key get" with key="dm-crypt/osd/'$OSD_UUID'/luks"' \ - --keyring /etc/ceph/admin-keyring-store/keyring > "$LOCKBOX_KEYRING_FILE"; then + --keyring /etc/ceph/admin-keyring-store/keyring > /tmp/lockbox.keyring; then echo "failed to get latest cephx lockbox key for OSD. continuing OSD startup using on-disk key" >/dev/stderr # allowing OSD to attempt to start could avoid full OSD outage due to mon/system issues + else + echo "got latest cephx lockbox key for OSD successfully. updating on-disk key" >/dev/stderr + mv /tmp/lockbox.keyring "$LOCKBOX_KEYRING_FILE" fi fi