From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id 310211FF09C for ; Mon, 19 Oct 2026 16:50:58 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 1E07321643; Mon, 19 Oct 2026 16:49:19 +0200 (CEST) Message-ID: <7e455243-78e3-4236-b392-c77f85085aa2@proxmox.com> Date: Mon, 19 Oct 2026 16:47:10 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Beta Subject: Re: [PATCH manager v2 0/4] cephx: migrate keys with a monitor this cluster does not manage To: Kefu Chai , pve-devel@lists.proxmox.com References: <20261019082346.1781960-1-k.chai@proxmox.com> Content-Language: en-US From: Jonas Theisen In-Reply-To: <20261019082346.1781960-1-k.chai@proxmox.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1792421230741 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.126 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: YG2JAPWCVNRQAQIWP3L2TDMVP74HNIL5 X-Message-ID-Hash: YG2JAPWCVNRQAQIWP3L2TDMVP74HNIL5 X-MailFrom: j.theisen@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Thomas Lamprecht X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: On 10/19/26 10:23, Kefu Chai wrote: > Hi everyone, > > A user reported an interesting stretch-cluster setup that > pve-cephx-rotate-service-keys wasn't ready for: a tiebreaker monitor > running on a standalone Proxmox VE host that isn't a node of the > cluster itself, joined to the corosync quorum only through a QDevice > and never listed under /etc/pve/nodes. All five monitors were in > quorum and on the same, capable Ceph version, but the dry run still > failed twice over: > > This issue is currently also present in a support ticket. Tested this against a virtual 4-node PVE cluster with a fifth PVE node outside the cluster as tiebreaker. Without the patches as expected the migration helper fails. With the patches and the instructed commands from the migration helper manually run on the separate node, the migration was successful. Small knit: The message during the admin keyring migration telling the operator to manually update the key on the external node is not highlighted in any way and such i nearly overlooked it. Maybe this can be rendered as a warning. Apart from that, consider this: Tested-by: Jonas Theisen