From 3082ed5b28229389bc47bb5ef03a935ec47e4c59 Mon Sep 17 00:00:00 2001 From: Bertrand Lanson Date: Tue, 12 May 2026 20:11:39 +0200 Subject: docs: warn about password resets in ceph RGW doc Keeping this value to true with external RGW as object storage endpoints can cause outages that are annoying to recover from. We should warn operators about this. Change-Id: I37965382bed6b9762782ec3f9ec3103143d738cc Signed-off-by: Bertrand Lanson (cherry picked from commit 8510b763fec5fbfdcd677177809c682eb69e97dc) --- doc/source/reference/storage/external-ceph-guide.rst | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'doc') diff --git a/doc/source/reference/storage/external-ceph-guide.rst b/doc/source/reference/storage/external-ceph-guide.rst index a831015ba..90d488b19 100644 --- a/doc/source/reference/storage/external-ceph-guide.rst +++ b/doc/source/reference/storage/external-ceph-guide.rst @@ -537,6 +537,15 @@ This prevents cross-project and public object access. This can be resolved by setting ``ceph_rgw_swift_account_in_url`` to ``true``. This should match the ``rgw_swift_account_in_url`` configuration option in Ceph RadosGW. +.. warning:: + + When using an external Ceph RadosGW for object storage endpoints + (when ``enable_ceph_rgw: true``), operators are advised to set + ``update_keystone_service_user_passwords: false`` in``globals.yml``. + Leaving this option enabled causes the service user password to be reset + on every reconfigure, which invalidates existing tokens and can cause + unforeseen outages for object storage consumers. + Load balancing ============== -- cgit v1.2.3