[PATCH ceph tentacle-stable-9] patches: link the PVE cephx migration docs in the insecure key warnings

[PATCH ceph tentacle-stable-9] patches: link the PVE cephx migration docs in the insecure key warnings

[Kefu Chai]

Ceph 19.2.6 and 20.2.4 added health checks for keys, service tickets and
cipher settings that still use aes. A node picking up the point release
starts reporting them, and the summary that `ceph -s` prints says only
that something is insecure, not what to do about it. The migration on
PVE goes through pve-cephx-rotate-service-keys, which also updates the
key copies that PVE manages, so the upstream procedure is not what a
user should follow here.

Append the link to our migration docs to the summaries of the six checks
those docs cover.

The link is only useful on PVE, so there is no upstream commit behind
this patch: it is ours, and it stays in the series.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 ...link-the-PVE-cephx-migration-docs-in.patch | 95 +++++++++++++++++++
 patches/series                                |  1 +
 2 files changed, 96 insertions(+)
 create mode 100644 patches/0019-mon-AuthMonitor-link-the-PVE-cephx-migration-docs-in.patch

diff --git a/patches/0019-mon-AuthMonitor-link-the-PVE-cephx-migration-docs-in.patch b/patches/0019-mon-AuthMonitor-link-the-PVE-cephx-migration-docs-in.patch
new file mode 100644
index 0000000000..0f34d03b2a
--- /dev/null
+++ b/patches/0019-mon-AuthMonitor-link-the-PVE-cephx-migration-docs-in.patch
@@ -0,0 +1,95 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Kefu Chai <k.chai@proxmox.com>
+Date: Thu, 15 Oct 2026 18:34:37 +0800
+Subject: [PATCH] mon/AuthMonitor: link the PVE cephx migration docs in
+ insecure key warnings
+
+Ceph 19.2.6 and 20.2.4 added health checks for keys, service tickets
+and cipher settings that still use aes, so PVE users can see them right
+after a point release upgrade without knowing what to do next. The
+migration has to be done with the pve-cephx-rotate-service-keys helper,
+which also updates the key copies managed by PVE, instead of the
+upstream procedure.
+
+Add the link to the PVE migration docs to the summaries of the six
+checks the docs cover, since `ceph -s` only prints summaries.
+
+The summaries point at the PVE documentation, so this change is not
+meant for upstream. It lives in the Proxmox patch series.
+
+Signed-off-by: Kefu Chai <k.chai@proxmox.com>
+---
+ src/mon/AuthMonitor.cc | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/src/mon/AuthMonitor.cc b/src/mon/AuthMonitor.cc
+index 00d3fe99344..41e2b05ee26 100644
+--- a/src/mon/AuthMonitor.cc
++++ b/src/mon/AuthMonitor.cc
+@@ -479,6 +479,12 @@ void AuthMonitor::encode_pending(MonitorDBStore::TransactionRef t)
+   check_health();
+ }
+ 
++static std::string with_cephx_migration_doc(std::string_view summary)
++{
++  return std::string{summary} +
++    ", see https://pve.proxmox.com/pve-docs/chapter-pveceph.html#pveceph_cephx_migration";
++}
++
+ bool AuthMonitor::check_health()
+ {
+   auto& next = get_health_checks_pending_writeable();
+@@ -498,7 +504,7 @@ bool AuthMonitor::check_health()
+       }
+     }
+     if (!details.empty()) {
+-      auto& check = next.add("AUTH_INSECURE_KEYS_ALLOWED", HEALTH_WARN, "Monitors are configured to allow auth using insecure key types", details.size());
++      auto& check = next.add("AUTH_INSECURE_KEYS_ALLOWED", HEALTH_WARN, with_cephx_migration_doc("Monitors are configured to allow auth using insecure key types"), details.size());
+       for (auto& detail : details) {
+         check.detail.push_back(detail);
+       }
+@@ -510,7 +516,7 @@ bool AuthMonitor::check_health()
+   }
+ 
+   if (cct->_conf.get_val<bool>("mon_auth_allow_insecure_key")) {
+-    next.add("AUTH_INSECURE_KEYS_CREATABLE", HEALTH_WARN, "Monitors are configured to allow creation of insecure key types", 1);
++    next.add("AUTH_INSECURE_KEYS_CREATABLE", HEALTH_WARN, with_cephx_migration_doc("Monitors are configured to allow creation of insecure key types"), 1);
+   }
+ 
+   if (auto c = cct->_conf.get_val<std::string>("mon_auth_emergency_allowed_ciphers"); !c.empty()) {
+@@ -520,7 +526,7 @@ bool AuthMonitor::check_health()
+   {
+     auto service_key_type = mon.monmap->auth_service_cipher;
+     if (!secure_key_types.contains(service_key_type)) {
+-      next.add("AUTH_INSECURE_SERVICE_TICKETS", HEALTH_ERR, "Monitors are configured to issue insecure service tickets", 1);
++      next.add("AUTH_INSECURE_SERVICE_TICKETS", HEALTH_ERR, with_cephx_migration_doc("Monitors are configured to issue insecure service tickets"), 1);
+     }
+   }
+ 
+@@ -595,7 +601,7 @@ bool AuthMonitor::check_health()
+   if (!bad_key_client_detail.empty()) {
+     std::ostringstream summary;
+     summary << bad_key_client_detail.size() << " auth client entities with insecure key types";
+-    auto& check = next.add("AUTH_INSECURE_CLIENT_KEY_TYPE", HEALTH_WARN, summary.str(), bad_key_client_detail.size());
++    auto& check = next.add("AUTH_INSECURE_CLIENT_KEY_TYPE", HEALTH_WARN, with_cephx_migration_doc(summary.str()), bad_key_client_detail.size());
+     for (auto& [name, detail] : bad_key_client_detail) {
+       check.detail.push_back(detail);
+     }
+@@ -603,7 +609,7 @@ bool AuthMonitor::check_health()
+   if (!bad_key_service_detail.empty()) {
+     std::ostringstream summary;
+     summary << bad_key_service_detail.size() << " auth service entities with insecure key types";
+-    auto& check = next.add("AUTH_INSECURE_SERVICE_KEY_TYPE", HEALTH_ERR, summary.str(), bad_key_service_detail.size());
++    auto& check = next.add("AUTH_INSECURE_SERVICE_KEY_TYPE", HEALTH_ERR, with_cephx_migration_doc(summary.str()), bad_key_service_detail.size());
+     for (auto& [name, detail] : bad_key_service_detail) {
+       check.detail.push_back(detail);
+     }
+@@ -641,7 +647,7 @@ bool AuthMonitor::check_health()
+   if (!bad_rotating_service_keys.empty()) {
+     std::ostringstream summary;
+     summary << bad_rotating_service_keys.size() << " rotating auth service keys using insecure key types";
+-    auto& check = next.add("AUTH_INSECURE_ROTATING_SERVICE_KEY_TYPE", HEALTH_WARN, summary.str(), bad_rotating_service_keys.size());
++    auto& check = next.add("AUTH_INSECURE_ROTATING_SERVICE_KEY_TYPE", HEALTH_WARN, with_cephx_migration_doc(summary.str()), bad_rotating_service_keys.size());
+     for (auto& detail : bad_rotating_service_keys) {
+       check.detail.push_back(detail);
+     }
diff --git a/patches/series b/patches/series
index f6b8fda5f7..854eeb006b 100644
--- a/patches/series
+++ b/patches/series
@@ -19,3 +19,4 @@
 0015-bluefs-truncate-unused-allocation-on-close.patch
 0016-bluefs-fix-use_direct_io-override.patch
 0017-bluefs-acquire-file-lock-in-truncate.patch
+0019-mon-AuthMonitor-link-the-PVE-cephx-migration-docs-in.patch
-- 
2.47.3

Re: [PATCH ceph tentacle-stable-9] patches: link the PVE cephx migration docs in the insecure key warnings

[Kefu Chai]

Superseded-by: https://lore.proxmox.com/pve-devel/20261016103128.3895688-1-k.chai@proxmox.com/