From: Jonas Theisen <j.theisen@proxmox.com>
To: Kefu Chai <k.chai@proxmox.com>, pve-devel@lists.proxmox.com
Cc: Thomas Lamprecht <t.lamprecht@proxmox.com>
Subject: Re: [PATCH manager v2 0/4] cephx: migrate keys with a monitor this cluster does not manage
Date: Mon, 19 Oct 2026 16:47:10 +0200 [thread overview]
Message-ID: <7e455243-78e3-4236-b392-c77f85085aa2@proxmox.com> (raw)
In-Reply-To: <20261019082346.1781960-1-k.chai@proxmox.com>
On 10/19/26 10:23, Kefu Chai wrote:
> Hi everyone,
>
> A user reported an interesting stretch-cluster setup that
> pve-cephx-rotate-service-keys wasn't ready for: a tiebreaker monitor
> running on a standalone Proxmox VE host that isn't a node of the
> cluster itself, joined to the corosync quorum only through a QDevice
> and never listed under /etc/pve/nodes. All five monitors were in
> quorum and on the same, capable Ceph version, but the dry run still
> failed twice over:
>
> <snip>
This issue is currently also present in a support ticket.
Tested this against a virtual 4-node PVE cluster with a fifth
PVE node outside the cluster as tiebreaker.
Without the patches as expected the migration helper fails.
With the patches and the instructed commands from the migration
helper manually run on the separate node, the migration was successful.
Small knit: The message during the admin keyring migration telling
the operator to manually update the key on the external node
is not highlighted in any way and such i nearly overlooked it.
Maybe this can be rendered as a warning.
Apart from that, consider this:
Tested-by: Jonas Theisen <j.theisen@proxmox.com>
next prev parent reply other threads:[~2026-10-19 14:50 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-19 8:23 [PATCH manager v2 0/4] cephx: migrate keys with a monitor this cluster does not manage Kefu Chai
2026-10-19 8:23 ` [PATCH manager v2 1/4] migrations: cephx: ask a monitor about itself through one route Kefu Chai
2026-10-19 8:23 ` [PATCH manager v2 2/4] migrations: cephx: judge cipher support by the version a daemon runs Kefu Chai
2026-10-19 8:23 ` [PATCH manager v2 3/4] migrations: cephx: rotate the monitor key with monitors we do not manage Kefu Chai
2026-10-19 8:23 ` [PATCH manager v2 4/4] migrations: cephx: name the hosts keeping key copies we cannot write Kefu Chai
2026-10-19 14:47 ` Jonas Theisen [this message]
2026-10-19 18:23 ` applied: [PATCH manager v2 0/4] cephx: migrate keys with a monitor this cluster does not manage Thomas Lamprecht
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=7e455243-78e3-4236-b392-c77f85085aa2@proxmox.com \
--to=j.theisen@proxmox.com \
--cc=k.chai@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
--cc=t.lamprecht@proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.