[ClusterLabs] pcs cluster auth with a key instead of password #179

[Miroslav Lisik]

Hi S Sathish S,

see my comments inline.

On 8/17/26 10:40, S Sathish S via Users wrote:
>
> Hi Team,
>
> We are running PCS 0.12.2 on RHEL 8 with Pacemaker 3.0.1 and Corosync 
> 3.1.10. Our security compliance framework (CIS Benchmarks, 
> vendor-specific GPRs) requires that all OS accounts have password 
> expiry policies enforced. The hacluster account used by pcs cluster 
> auth currently requires a static password, which conflicts with this 
> requirement.
>
I believe you could set password expiration dates for hacluster accout 
with the `passwd` and `chage` utilites.
>
> We are aware of the long-standing feature request pcs#179 (key-based 
> authentication, opened 2018). In March 2022, Tomas Jelinek confirmed 
> it was on the backlog with no ETA.
>
> Our questions:
>
> 1. Is there any updated timeline for key-based/certificate-based 
> authentication in PCS 0.12.x ?
>
There is no timeline in the foreseeable future for this feature.
>
> 2. Are there any alternative mechanisms in PCS 0.12.x to authenticate 
> nodes without relying on the hacluster password (e.g., token-based, 
> certificate mutual TLS)?
>
Token-based authentication is used between cluster nodes after you run 
the `pcs
host auth` command using the hacluster password. After running this command,
tokens from the /var/lib/pcsd/known-hosts file are used. You can then
unset the password for the hacluster user account, unless you are using the
legacy pcs-web-ui without Cockpit.
>
> Our current workaround is periodic automated password rotation with 
> re-authentication across all cluster nodes, but this introduces 
> operational risk during the rotation window.
>
> Any guidance or roadmap update would be appreciated.
>
> Thanks and Regards,
> S Sathish S
>
>
> _______________________________________________
> Manage your subscription:
> https://lists.clusterlabs.org/mailman/listinfo/users
>
> ClusterLabs home: https://www.clusterlabs.org/
Regards,
Miroslav