From d69ffdfd2c21ce2a692572da4ec52010b569b081 Mon Sep 17 00:00:00 2001 From: Blaine Gardner Date: Mon, 9 Feb 2026 10:06:27 -0700 Subject: [PATCH] osd: in cephx key init, don't overwrite key on failure Previously, if the OSD cephx-keyring-update init container couldn't contact the mons, the output redirect would overwrite the on-disk keyring file with no text, removing the on-disk keyring. Modify the init container to only overwrite the keyring file when the ceph command to get the latest key suceeds, to avoid removing the on-disk key. Signed-off-by: Blaine Gardner --- pkg/operator/ceph/cluster/osd/spec.go | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/pkg/operator/ceph/cluster/osd/spec.go b/pkg/operator/ceph/cluster/osd/spec.go index 64e86cdeb..e267cc54e 100644 --- a/pkg/operator/ceph/cluster/osd/spec.go +++ b/pkg/operator/ceph/cluster/osd/spec.go @@ -1480,11 +1480,16 @@ set -o xtrace OSD_ID="` + osdID + `" KEYRING_FILE=/var/lib/ceph/osd/ceph-"${OSD_ID}"/keyring +# If this fails, it still writes to redirected file, so use temp file if ! ceph --name client.admin auth get-or-create osd."${OSD_ID}" \ mon 'allow profile osd' mgr 'allow profile osd' osd 'allow *' \ - --keyring /etc/ceph/admin-keyring-store/keyring > "$KEYRING_FILE"; then + --keyring /etc/ceph/admin-keyring-store/keyring > /tmp/keyring; then echo "failed to get latest cephx key for OSD. continuing OSD startup using on-disk key" >/dev/stderr + exit 0 fi + +echo "got latest cephx key for OSD successfully. updating on-disk key" >/dev/stderr +mv /tmp/keyring "$KEYRING_FILE" ` // ^ (above) Continue on failure here. Getting latest key can fail due to system issues that // blocking here could make worse. Key rotation is rare, so on-disk key is likely good. If not,