Re: [PATCH ceph squid-stable-9 v2] patches: link the PVE cephx migration docs in the insecure key warnings

[Maximiliano Sandoval <m.sandoval@proxmox.com>]

Kefu Chai <k.chai@proxmox.com> writes:

> Ceph 19.2.6 and 20.2.4 added health checks for keys, service tickets and
> cipher settings that still use aes. A node picking up the point release
> starts reporting them, and the summary that `ceph -s` prints says only
> that something is insecure, not what to do about it. The migration on
> PVE goes through pve-cephx-rotate-service-keys, which also updates the
> key copies that PVE manages, so the upstream procedure is not what a
> user should follow here.
>
> The web interface already explains every one of these checks and puts
> the guide next to it, but a user reading `ceph -s` or `ceph health` over
> ssh gets the summary and nothing else, so the link has to be in the
> summary too.
>
> Append it to AUTH_INSECURE_KEYS_ALLOWED and to nothing else. That check
> is raised for as long as the monitors still allow aes, and the allowed
> ciphers are restricted in the last of the three documented steps and
> only by the helper, so the link tracks whether the migration is
> finished. The other checks clear earlier: the two with error severity go
> away in step 1, the rotating service key warning expires by itself, and
> the last two are the ones the PVE docs tell users to mute while an
> incompatible client keeps the migration from finishing. Appending the
> url to those as well would print it up to six times in a single
> `ceph health` line and in the cluster log.
>
> The link is only useful on PVE, so there is no upstream commit behind
> this patch: it is ours, and it stays in the series.
>
> Signed-off-by: Kefu Chai <k.chai@proxmox.com>

This patch needs a rebase.

-- 
Maximiliano