Uploaded November 2025 | Updated September 2026, 2 weeks ago
Rotating Heads and CephX Keys - Patrick Donnelly, IBM & Yehuda Sadeh Weinraub, Ubiquiti
Since the first public release, the CephX key management system is Ceph's take on a Kerberos-style authentication and authorization scheme in the context of a distributed storage system. The system maintains a straightforward key infrastructure while simplifying authorization to a range of identical Ceph services, like OSDs or MDSs. In upcoming releases of Ceph, the recommended key type will change to support a stronger and more resilient encryption scheme. After upgrading your clusters, you will see a dizzying array of warnings indicating that urgent action is required.
This talk will cover the rationale for these changes, the new mechanisms for distributed key rotation and updates, as well as improvements to security.
Rotating Heads and CephX Keys - Patrick Donnelly, IBM & Yehuda Sadeh Weinraub, Ubiquiti
Since the first public release, the CephX key management system is Ceph's take on a Kerberos-style authentication and authorization scheme in the context of a distributed storage system. The system maintains a straightforward key infrastructure while simplifying authorization to a range of identical Ceph services, like OSDs or MDSs. In upcoming releases of Ceph, the recommended key type will change to support a stronger and more resilient encryption scheme. After upgrading your clusters, you will see a dizzying array of warnings indicating that urgent action is required.
This talk will cover the rationale for these changes, the new mechanisms for distributed key rotation and updates, as well as improvements to security.
