Repository: rook/rook
Pull request #16031 (2025-06-19 15:08:56)

doc: switch linux minikube driver from kvm2 to qemu2
update the developer guide to use the `qemu2` driver instead of `kvm2` for minikube on linux.

Fixes: #16032 
<!-- Thank you for contributing to Rook! -->

<!-- STEPS TO FOLLOW:
  1. Add a description of the changes (frequently the same as the commit description)
  2. Enter the issue number next to "Resolves #" below (if there is no tracking issue resolved, **remove that section**)
  3. Review our Contributing documentation at https://rook.io/docs/rook/latest/Contributing/development-flow/
  4. Follow the steps in the checklist below, starting with the **Commit Message Formatting**.
-->

<!-- Uncomment this section with the issue number if an issue is being resolved
**Issue resolved by this Pull Request:**
Resolves #
--->

**Checklist:**

- [ ] **Commit Message Formatting**: Commit titles and messages follow guidelines in the [developer guide](https://rook.io/docs/rook/latest/Contributing/development-flow/#commit-structure).
- [ ] Reviewed the developer guide on [Submitting a Pull Request](https://rook.io/docs/rook/latest/Contributing/development-flow/#submitting-a-pull-request)
- [ ] [Pending release notes](https://github.com/rook/rook/blob/master/PendingReleaseNotes.md) updated with breaking and/or notable changes for the next minor release.
- [ ] Documentation has been updated, if necessary.
- [ ] Unit tests have been added, if necessary.
- [ ] Integration tests have been added, if necessary.



Patch:
diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
index 5c38bdd06..0edaa0205 100644
--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -64,6 +64,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@39edc492dbe16b1465b0cafca41432d857bdb31a # v3.29.1
+        uses: github/codeql-action/upload-sarif@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3.29.0
         with:
           sarif_file: results.sarif
diff --git a/Documentation/CRDs/specification.md b/Documentation/CRDs/specification.md
index 8678b827e..e24b01db5 100644
--- a/Documentation/CRDs/specification.md
+++ b/Documentation/CRDs/specification.md
@@ -592,32 +592,6 @@ string
 </tr>
 <tr>
 <td>
-<code>secretName</code><br/>
-<em>
-string
-</em>
-</td>
-<td>
-<em>(Optional)</em>
-<p>SecretName is the name of the secret created for this ceph client.
-If not specified, the default name is &ldquo;rook-ceph-client-&rdquo; as a prefix to the CR name.</p>
-</td>
-</tr>
-<tr>
-<td>
-<code>removeSecret</code><br/>
-<em>
-bool
-</em>
-</td>
-<td>
-<em>(Optional)</em>
-<p>RemoveSecret indicates whether the current secret for this ceph client should be removed or not.
-If true, the K8s secret will be deleted, but the cephx keyring will remain until the CR is deleted.</p>
-</td>
-</tr>
-<tr>
-<td>
 <code>caps</code><br/>
 <em>
 map[string]string
@@ -3120,19 +3094,6 @@ CSICephFSSpec
 <p>CephFS defines CSI Driver settings for CephFS driver.</p>
 </td>
 </tr>
-<tr>
-<td>
-<code>skipUserCreation</code><br/>
-<em>
-bool
-</em>
-</td>
-<td>
-<em>(Optional)</em>
-<p>SkipUserCreation determines whether CSI users and their associated secrets should be skipped.
-If set to true, the user must manually manage these secrets.</p>
-</td>
-</tr>
 </tbody>
 </table>
 <h3 id="ceph.rook.io/v1.Capacity">Capacity
@@ -3906,18 +3867,6 @@ int64
 <p>Time to wait before sending requests again to exporter server (seconds)</p>
 </td>
 </tr>
-<tr>
-<td>
-<code>hostNetwork</code><br/>
-<em>
-bool
-</em>
-</td>
-<td>
-<em>(Optional)</em>
-<p>Whether host networking is enabled for CephExporter. If not set, the network settings from CephCluster.spec.networking will be applied.</p>
-</td>
-</tr>
 </tbody>
 </table>
 <h3 id="ceph.rook.io/v1.CephFilesystemStatus">CephFilesystemStatus
@@ -4712,32 +4661,6 @@ string
 </tr>
 <tr>
 <td>
-<code>secretName</code><br/>
-<em>
-string
-</em>
-</td>
-<td>
-<em>(Optional)</em>
-<p>SecretName is the name of the secret created for this ceph client.
-If not specified, the default name is &ldquo;rook-ceph-client-&rdquo; as a prefix to the CR name.</p>
-</td>
-</tr>
-<tr>
-<td>
-<code>removeSecret</code><br/>
-<em>
-bool
-</em>
-</td>
-<td>
-<em>(Optional)</em>
-<p>RemoveSecret indicates whether the current secret for this ceph client should be removed or not.
-If true, the K8s secret will be deleted, but the cephx keyring will remain until the CR is deleted.</p>
-</td>
-</tr>
-<tr>
-<td>
 <code>caps</code><br/>
 <em>
 map[string]string
diff --git a/Documentation/Contributing/development-environment.md b/Documentation/Contributing/development-environment.md
index a7081a093..40f200f2f 100644
--- a/Documentation/Contributing/development-environment.md
+++ b/Documentation/Contributing/development-environment.md
@@ -18,7 +18,7 @@ issues deploying Rook.
 
 To install Minikube follow the [official
 guide](https://minikube.sigs.k8s.io/docs/start/). It is recommended to use the
-kvm2 driver when running on a Linux machine and the hyperkit driver when running on a MacOS. Both
+qemu2 driver when running on a Linux machine and the hyperkit driver when running on a MacOS. Both
 allow to create and attach additional disks to the virtual machine. This is required for the Ceph
 OSD to consume one drive.  We don't recommend any other drivers for Rook. You will need a Minikube
 version 1.23 or higher.
@@ -27,7 +27,7 @@ Starting the cluster on Minikube is as simple as running:
 
 ```console
 # On Linux
-minikube start --disk-size=40g --extra-disks=1 --driver kvm2
+minikube start --disk-size=40g --extra-disks=1 --driver qemu2
 
 # On MacOS with Intel processor
 minikube start --disk-size=40g --extra-disks=1 --driver hyperkit
diff --git a/Documentation/Helm-Charts/ceph-cluster-chart.gotmpl.md b/Documentation/Helm-Charts/ceph-cluster-chart.gotmpl.md
index 406c47d3b..1420bc5ef 100644
--- a/Documentation/Helm-Charts/ceph-cluster-chart.gotmpl.md
+++ b/Documentation/Helm-Charts/ceph-cluster-chart.gotmpl.md
@@ -13,7 +13,7 @@ This chart is a simple packaging of templates that will optionally create Rook r
 
 ## Prerequisites
 
-* Helm 3.13+
+* Helm 3.x
 * Install the [Rook Operator chart](operator-chart.md)
 
 ## Installing
diff --git a/Documentation/Helm-Charts/ceph-cluster-chart.md b/Documentation/Helm-Charts/ceph-cluster-chart.md
index 18bbcf799..1fbee4ddd 100644
--- a/Documentation/Helm-Charts/ceph-cluster-chart.md
+++ b/Documentation/Helm-Charts/ceph-cluster-chart.md
@@ -16,7 +16,7 @@ This chart is a simple packaging of templates that will optionally create Rook r
 
 ## Prerequisites
 
-* Helm 3.13+
+* Helm 3.x
 * Install the [Rook Operator chart](operator-chart.md)
 
 ## Installing
diff --git a/Documentation/Helm-Charts/operator-chart.gotmpl.md b/Documentation/Helm-Charts/operator-chart.gotmpl.md
index 997d35e9d..a8f4a8943 100644
--- a/Documentation/Helm-Charts/operator-chart.gotmpl.md
+++ b/Documentation/Helm-Charts/operator-chart.gotmpl.md
@@ -11,7 +11,7 @@ This chart bootstraps a [rook-ceph-operator](https://github.com/rook/rook) deplo
 
 ## Prerequisites
 
-* Helm 3.13+
+* Helm 3.x
 
 See the [Helm support matrix](https://helm.sh/docs/topics/version_skew/) for more details.
 
diff --git a/Documentation/Helm-Charts/operator-chart.md b/Documentation/Helm-Charts/operator-chart.md
index 8ba900fe1..09cb920d5 100644
--- a/Documentation/Helm-Charts/operator-chart.md
+++ b/Documentation/Helm-Charts/operator-chart.md
@@ -14,7 +14,7 @@ This chart bootstraps a [rook-ceph-operator](https://github.com/rook/rook) deplo
 
 ## Prerequisites
 
-* Helm 3.13+
+* Helm 3.x
 
 See the [Helm support matrix](https://helm.sh/docs/topics/version_skew/) for more details.
 
@@ -57,7 +57,7 @@ The following table lists the configurable parameters of the rook-operator chart
 | `csi.cephFSPluginUpdateStrategy` | CSI CephFS plugin daemonset update strategy, supported values are OnDelete and RollingUpdate | `RollingUpdate` |
 | `csi.cephFSPluginUpdateStrategyMaxUnavailable` | A maxUnavailable parameter of CSI cephFS plugin daemonset update strategy. | `1` |
 | `csi.cephcsi.repository` | Ceph CSI image repository | `"quay.io/cephcsi/cephcsi"` |
-| `csi.cephcsi.tag` | Ceph CSI image tag | `"v3.14.1"` |
+| `csi.cephcsi.tag` | Ceph CSI image tag | `"v3.14.0"` |
 | `csi.cephfsLivenessMetricsPort` | CSI CephFS driver metrics port | `9081` |
 | `csi.cephfsPodLabels` | Labels to add to the CSI CephFS Deployments and DaemonSets Pods | `nil` |
 | `csi.clusterName` | Cluster name identifier to set as metadata on the CephFS subvolume and RBD images. This will be useful in cases like for example, when two container orchestrator clusters (Kubernetes/OCP) are using a single ceph cluster | `nil` |
diff --git a/Documentation/Storage-Configuration/Ceph-CSI/ceph-csi-drivers.md b/Documentation/Storage-Configuration/Ceph-CSI/ceph-csi-drivers.md
index a1d2819d2..5b59f41e3 100644
--- a/Documentation/Storage-Configuration/Ceph-CSI/ceph-csi-drivers.md
+++ b/Documentation/Storage-Configuration/Ceph-CSI/ceph-csi-drivers.md
@@ -217,10 +217,10 @@ CSI-Addons supports the following operations:
 
 Ceph-CSI supports encrypting PersistentVolumeClaims (PVCs) for both RBD and CephFS.
 This can be achieved using LUKS for RBD and fscrypt for CephFS. More details on encrypting RBD PVCs can be found
-[here](https://github.com/ceph/ceph-csi/blob/v3.14.1/docs/deploy-rbd.md#encryption-for-rbd-volumes),
+[here](https://github.com/ceph/ceph-csi/blob/v3.14.0/docs/deploy-rbd.md#encryption-for-rbd-volumes),
 which includes a full list of supported encryption configurations.
-More details on encrypting CephFS PVCs can be found [here](https://github.com/ceph/ceph-csi/blob/v3.14.1/docs/deploy-cephfs.md#cephfs-volume-encryption).
-A sample KMS configmap can be found [here](https://github.com/ceph/ceph-csi/blob/v3.14.1/examples/kms/vault/kms-config.yaml).
+More details on encrypting CephFS PVCs can be found [here](https://github.com/ceph/ceph-csi/blob/v3.14.0/docs/deploy-cephfs.md#cephfs-volume-encryption).
+A sample KMS configmap can be found [here](https://github.com/ceph/ceph-csi/blob/v3.14.0/examples/kms/vault/kms-config.yaml).
 
 !!! note
     Not all KMS are compatible with fscrypt. Generally, KMS that either store secrets to use directly (like Vault)
diff --git a/Documentation/Storage-Configuration/Ceph-CSI/custom-images.md b/Documentation/Storage-Configuration/Ceph-CSI/custom-images.md
index d374008de..72058188e 100644
--- a/Documentation/Storage-Configuration/Ceph-CSI/custom-images.md
+++ b/Documentation/Storage-Configuration/Ceph-CSI/custom-images.md
@@ -18,7 +18,7 @@ kubectl -n $ROOK_OPERATOR_NAMESPACE edit configmap rook-ceph-operator-config
 The default upstream images are included below, which you can change to your desired images.
 
 ```yaml
-ROOK_CSI_CEPH_IMAGE: "quay.io/cephcsi/cephcsi:v3.14.1"
+ROOK_CSI_CEPH_IMAGE: "quay.io/cephcsi/cephcsi:v3.14.0"
 ROOK_CSI_REGISTRAR_IMAGE: "registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.13.0"
 ROOK_CSI_PROVISIONER_IMAGE: "registry.k8s.io/sig-storage/csi-provisioner:v5.2.0"
 ROOK_CSI_ATTACHER_IMAGE: "registry.k8s.io/sig-storage/csi-attacher:v4.8.1"
diff --git a/Documentation/Upgrade/ceph-upgrade.md b/Documentation/Upgrade/ceph-upgrade.md
index 9256d71af..c3ba61186 100644
--- a/Documentation/Upgrade/ceph-upgrade.md
+++ b/Documentation/Upgrade/ceph-upgrade.md
@@ -24,7 +24,7 @@ until all the daemons have been updated.
 
 ## Supported Versions
 
-The following Ceph versions are supported in this release of Rook:
+Rook v1.16 supports the following Ceph versions:
 
 * Ceph Squid v19.2.0 or newer
 * Ceph Reef v18.2.0 or newer
diff --git a/PendingReleaseNotes.md b/PendingReleaseNotes.md
index 18a1ba7a1..039978b87 100644
--- a/PendingReleaseNotes.md
+++ b/PendingReleaseNotes.md
@@ -4,6 +4,3 @@
 
 
 ## Features
-
-
-- Previously, only the latest version of helm was tested and the docs stated only version 3.x of helm as a prerequisite. Now rook supports the six most recent minor versions of helm along with their their patch updates. Explicitly, helm versions 3.13 and newer are supported.
\ No newline at end of file
diff --git a/build/release/Makefile b/build/release/Makefile
index 7dd07501b..99928ef02 100644
--- a/build/release/Makefile
+++ b/build/release/Makefile
@@ -121,7 +121,7 @@ promote.helm: $(HELM)
 #	copy existing charts to a temp dir, then combine with new charts, reindex, and upload
 	$(S3_SYNC) s3://$(HELM_S3_BUCKET)/$(HELM_CHANNEL) $(HELM_TEMP)
 	$(S3_SYNC) s3://$(S3_BUCKET)/build/$(BRANCH_NAME)/$(VERSION)/charts $(HELM_TEMP)
-	$(HELM) repo index --url $(HELM_URL) --merge $(HELM_TEMP)/index.yaml $(HELM_TEMP)
+	$(HELM) repo index --url $(HELM_URL) $(HELM_TEMP)
 	$(S3_SYNC_DEL) $(HELM_TEMP) s3://$(HELM_S3_BUCKET)/$(HELM_CHANNEL)
 	rm -fr $(HELM_TEMP)
 
diff --git a/deploy/charts/rook-ceph/templates/resources.yaml b/deploy/charts/rook-ceph/templates/resources.yaml
index f259111d8..28ac9cf7d 100644
--- a/deploy/charts/rook-ceph/templates/resources.yaml
+++ b/deploy/charts/rook-ceph/templates/resources.yaml
@@ -1293,19 +1293,6 @@ spec:
                   x-kubernetes-preserve-unknown-fields: true
                 name:
                   type: string
-                removeSecret:
-                  description: |-
-                    RemoveSecret indicates whether the current secret for this ceph client should be removed or not.
-                    If true, the K8s secret will be deleted, but the cephx keyring will remain until the CR is deleted.
-                  type: boolean
-                secretName:
-                  description: |-
-                    SecretName is the name of the secret created for this ceph client.
-                    If not specified, the default name is "rook-ceph-client-" as a prefix to the CR name.
-                  type: string
-                  x-kubernetes-validations:
-                    - message: SecretName is immutable and cannot be changed
-                      rule: self == oldSelf
               required:
                 - caps
               type: object
@@ -1560,11 +1547,6 @@ spec:
                           description: Enables read affinity for CSI driver.
                           type: boolean
                       type: object
-                    skipUserCreation:
-                      description: |-
-                        SkipUserCreation determines whether CSI users and their associated secrets should be skipped.
-                        If set to true, the user must manually manage these secrets.
-                      type: boolean
                   type: object
                 dashboard:
                   description: Dashboard settings
@@ -2795,10 +2777,6 @@ spec:
                     exporter:
                       description: Ceph exporter configuration
                       properties:
-                        hostNetwork:
-                          description: Whether host networking is enabled for CephExporter. If not set, the network settings from CephCluster.spec.networking will be applied.
-                          nullable: true
-                          type: boolean
                         perfCountersPrioLimit:
                           default: 5
                           description: Only performance counters greater than or equal to this option are fetched
diff --git a/deploy/charts/rook-ceph/values.yaml b/deploy/charts/rook-ceph/values.yaml
index 30245db7b..123eb1b15 100644
--- a/deploy/charts/rook-ceph/values.yaml
+++ b/deploy/charts/rook-ceph/values.yaml
@@ -489,7 +489,7 @@ csi:
     # -- Ceph CSI image repository
     repository: quay.io/cephcsi/cephcsi
     # -- Ceph CSI image tag
-    tag: v3.14.1
+    tag: v3.14.0
 
   registrar:
     # -- Kubernetes CSI registrar image repository
diff --git a/deploy/examples/crds.yaml b/deploy/examples/crds.yaml
index 89d6411a1..d34ad9a60 100644
--- a/deploy/examples/crds.yaml
+++ b/deploy/examples/crds.yaml
@@ -1292,19 +1292,6 @@ spec:
                   x-kubernetes-preserve-unknown-fields: true
                 name:
                   type: string
-                removeSecret:
-                  description: |-
-                    RemoveSecret indicates whether the current secret for this ceph client should be removed or not.
-                    If true, the K8s secret will be deleted, but the cephx keyring will remain until the CR is deleted.
-                  type: boolean
-                secretName:
-                  description: |-
-                    SecretName is the name of the secret created for this ceph client.
-                    If not specified, the default name is "rook-ceph-client-" as a prefix to the CR name.
-                  type: string
-                  x-kubernetes-validations:
-                    - message: SecretName is immutable and cannot be changed
-                      rule: self == oldSelf
               required:
                 - caps
               type: object
@@ -1558,11 +1545,6 @@ spec:
                           description: Enables read affinity for CSI driver.
                           type: boolean
                       type: object
-                    skipUserCreation:
-                      description: |-
-                        SkipUserCreation determines whether CSI users and their associated secrets should be skipped.
-                        If set to true, the user must manually manage these secrets.
-                      type: boolean
                   type: object
                 dashboard:
                   description: Dashboard settings
@@ -2793,10 +2775,6 @@ spec:
                     exporter:
                       description: Ceph exporter configuration
                       properties:
-                        hostNetwork:
-                          description: Whether host networking is enabled for CephExporter. If not set, the network settings from CephCluster.spec.networking will be applied.
-                          nullable: true
-                          type: boolean
                         perfCountersPrioLimit:
                           default: 5
                           description: Only performance counters greater than or equal to this option are fetched
diff --git a/deploy/examples/images.txt b/deploy/examples/images.txt
index 2d193f21f..8f7bb0890 100644
--- a/deploy/examples/images.txt
+++ b/deploy/examples/images.txt
@@ -2,7 +2,7 @@
  gcr.io/k8s-staging-sig-storage/objectstorage-sidecar:v20240513-v0.1.0-35-gefb3255
  quay.io/ceph/ceph:v19.2.2
  quay.io/ceph/cosi:v0.1.2
- quay.io/cephcsi/cephcsi:v3.14.1
+ quay.io/cephcsi/cephcsi:v3.14.0
  quay.io/csiaddons/k8s-sidecar:v0.12.0
  registry.k8s.io/sig-storage/csi-attacher:v4.8.1
  registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.13.0
diff --git a/deploy/examples/operator-openshift.yaml b/deploy/examples/operator-openshift.yaml
index 77c09494e..d0569fd0d 100644
--- a/deploy/examples/operator-openshift.yaml
+++ b/deploy/examples/operator-openshift.yaml
@@ -189,7 +189,7 @@ data:
   # The default version of CSI supported by Rook will be started. To change the version
   # of the CSI driver to something other than what is officially supported, change
   # these images to the desired release of the CSI driver.
-  # ROOK_CSI_CEPH_IMAGE: "quay.io/cephcsi/cephcsi:v3.14.1"
+  # ROOK_CSI_CEPH_IMAGE: "quay.io/cephcsi/cephcsi:v3.14.0"
   # ROOK_CSI_REGISTRAR_IMAGE: "registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.13.0"
   # ROOK_CSI_RESIZER_IMAGE: "registry.k8s.io/sig-storage/csi-resizer:v1.13.2"
   # ROOK_CSI_PROVISIONER_IMAGE: "registry.k8s.io/sig-storage/csi-provisioner:v5.2.0"
diff --git a/deploy/examples/operator.yaml b/deploy/examples/operator.yaml
index d24a523bd..93e068442 100644
--- a/deploy/examples/operator.yaml
+++ b/deploy/examples/operator.yaml
@@ -119,7 +119,7 @@ data:
   # The default version of CSI supported by Rook will be started. To change the version
   # of the CSI driver to something other than what is officially supported, change
   # these images to the desired release of the CSI driver.
-  # ROOK_CSI_CEPH_IMAGE: "quay.io/cephcsi/cephcsi:v3.14.1"
+  # ROOK_CSI_CEPH_IMAGE: "quay.io/cephcsi/cephcsi:v3.14.0"
   # ROOK_CSI_REGISTRAR_IMAGE: "registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.13.0"
   # ROOK_CSI_RESIZER_IMAGE: "registry.k8s.io/sig-storage/csi-resizer:v1.13.2"
   # ROOK_CSI_PROVISIONER_IMAGE: "registry.k8s.io/sig-storage/csi-provisioner:v5.2.0"
diff --git a/pkg/apis/ceph.rook.io/v1/types.go b/pkg/apis/ceph.rook.io/v1/types.go
index a28f4668c..04bd2ed25 100755
--- a/pkg/apis/ceph.rook.io/v1/types.go
+++ b/pkg/apis/ceph.rook.io/v1/types.go
@@ -255,10 +255,6 @@ type CSIDriverSpec struct {
 	// CephFS defines CSI Driver settings for CephFS driver.
 	// +optional
 	CephFS CSICephFSSpec `json:"cephfs,omitempty"`
-	// SkipUserCreation determines whether CSI users and their associated secrets should be skipped.
-	// If set to true, the user must manually manage these secrets.
-	// +optional
-	SkipUserCreation bool `json:"skipUserCreation,omitempty"`
 }
 
 // CSICephFSSpec defines the settings for CephFS CSI driver.
@@ -481,11 +477,6 @@ type CephExporterSpec struct {
 	// Time to wait before sending requests again to exporter server (seconds)
 	// +kubebuilder:default=5
 	StatsPeriodSeconds int64 `json:"statsPeriodSeconds,omitempty"`
-
-	// Whether host networking is enabled for CephExporter. If not set, the network settings from CephCluster.spec.networking will be applied.
-	// +nullable
-	// +optional
-	HostNetwork *bool `json:"hostNetwork,omitempty"`
 }
 
 // ClusterStatus represents the status of a Ceph cluster
@@ -3088,16 +3079,6 @@ type CephClientList struct {
 type ClientSpec struct {
 	// +optional
 	Name string `json:"name,omitempty"`
-	// SecretName is the name of the secret created for this ceph client.
-	// If not specified, the default name is "rook-ceph-client-" as a prefix to the CR name.
-	// +kubebuilder:validation:XValidation:message="SecretName is immutable and cannot be changed",rule="self == oldSelf"
-	// +optional
-	SecretName string `json:"secretName,omitempty"`
-
-	// RemoveSecret indicates whether the current secret for this ceph client should be removed or not.
-	// If true, the K8s secret will be deleted, but the cephx keyring will remain until the CR is deleted.
-	// +optional
-	RemoveSecret bool `json:"removeSecret,omitempty"`
 	// +kubebuilder:pruning:PreserveUnknownFields
 	Caps map[string]string `json:"caps"`
 }
diff --git a/pkg/apis/ceph.rook.io/v1/zz_generated.deepcopy.go b/pkg/apis/ceph.rook.io/v1/zz_generated.deepcopy.go
index d29b16924..a292ee245 100644
--- a/pkg/apis/ceph.rook.io/v1/zz_generated.deepcopy.go
+++ b/pkg/apis/ceph.rook.io/v1/zz_generated.deepcopy.go
@@ -1046,11 +1046,6 @@ func (in *CephDaemonsVersions) DeepCopy() *CephDaemonsVersions {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *CephExporterSpec) DeepCopyInto(out *CephExporterSpec) {
 	*out = *in
-	if in.HostNetwork != nil {
-		in, out := &in.HostNetwork, &out.HostNetwork
-		*out = new(bool)
-		**out = **in
-	}
 	return
 }
 
@@ -3550,7 +3545,7 @@ func (in *MonitoringSpec) DeepCopyInto(out *MonitoringSpec) {
 	if in.Exporter != nil {
 		in, out := &in.Exporter, &out.Exporter
 		*out = new(CephExporterSpec)
-		(*in).DeepCopyInto(*out)
+		**out = **in
 	}
 	return
 }
diff --git a/pkg/daemon/ceph/osd/remove.go b/pkg/daemon/ceph/osd/remove.go
index 70d07e888..8cea71dcd 100644
--- a/pkg/daemon/ceph/osd/remove.go
+++ b/pkg/daemon/ceph/osd/remove.go
@@ -125,8 +125,10 @@ func removeOSD(clusterdContext *clusterd.Context, clusterInfo *client.ClusterInf
 	} else {
 		logger.Infof("removing the OSD deployment %q", deploymentName)
 		if err := k8sutil.DeleteDeployment(clusterInfo.Context, clusterdContext.Clientset, clusterInfo.Namespace, deploymentName); err != nil {
-			// Continue purging the OSD even if the deployment fails to be deleted
-			logger.Errorf("failed to delete deployment for OSD %d. %v", osdID, err)
+			if err != nil {
+				// Continue purging the OSD even if the deployment fails to be deleted
+				logger.Errorf("failed to delete deployment for OSD %d. %v", osdID, err)
+			}
 		}
 		if pvcName, ok := deployment.GetLabels()[oposd.OSDOverPVCLabelKey]; ok {
 			removeOSDPrepareJob(clusterdContext, clusterInfo, pvcName)
@@ -170,8 +172,10 @@ func removeOSDPrepareJob(clusterdContext *clusterd.Context, clusterInfo *client.
 	for _, prepareJob := range prepareJobList.Items {
 		logger.Infof("removing the osd prepare job %q", prepareJob.GetName())
 		if err := k8sutil.DeleteBatchJob(clusterInfo.Context, clusterdContext.Clientset, clusterInfo.Namespace, prepareJob.GetName(), false); err != nil {
-			// Continue with the cleanup even if the job fails to be deleted
-			logger.Errorf("failed to delete prepare job for osd %q. %v", prepareJob.GetName(), err)
+			if err != nil {
+				// Continue with the cleanup even if the job fails to be deleted
+				logger.Errorf("failed to delete prepare job for osd %q. %v", prepareJob.GetName(), err)
+			}
 		}
 	}
 }
@@ -208,8 +212,10 @@ func removePVCs(clusterdContext *clusterd.Context, clusterInfo *client.ClusterIn
 			// Remove the OSD PVC
 			logger.Infof("removing the OSD PVC %q", pvc.Name)
 			if err := clusterdContext.Clientset.CoreV1().PersistentVolumeClaims(clusterInfo.Namespace).Delete(clusterInfo.Context, pvc.Name, metav1.DeleteOptions{}); err != nil {
-				// Continue deleting the OSD PVC even if PVC deletion fails
-				logger.Errorf("failed to delete pvc %q for OSD. %v", pvc.Name, err)
+				if err != nil {
+					// Continue deleting the OSD PVC even if PVC deletion fails
+					logger.Errorf("failed to delete pvc %q for OSD. %v", pvc.Name, err)
+				}
 			}
 		}
 	}
diff --git a/pkg/operator/ceph/client/controller.go b/pkg/operator/ceph/client/controller.go
index 1c36a46a7..8f3e64bbd 100644
--- a/pkg/operator/ceph/client/controller.go
+++ b/pkg/operator/ceph/client/controller.go
@@ -285,45 +285,34 @@ func (r *ReconcileCephClient) createOrUpdateClient(cephClient *cephv1.CephClient
 		},
 		Type: k8sutil.RookType,
 	}
-	return r.reconcileCephClientSecret(cephClient, secret)
-}
-
-func (r *ReconcileCephClient) reconcileCephClientSecret(
-	cephClient *cephv1.CephClient,
-	secret *v1.Secret,
-) error {
-	// Fetch existing secret
-	_, getSecretErr := r.context.Clientset.CoreV1().
-		Secrets(secret.Namespace).
-		Get(r.clusterInfo.Context, secret.Name, metav1.GetOptions{})
-	if getSecretErr != nil && !kerrors.IsNotFound(getSecretErr) {
-		return errors.Wrapf(getSecretErr, "error fetching secret %q", secret.Name)
-	}
 
-	if err := controllerutil.SetControllerReference(cephClient, secret, r.scheme); err != nil {
-		return errors.Wrapf(err, "failed to set owner reference on secret %q", secret.Name)
+	// Set CephClient owner ref to the Secret
+	err = controllerutil.SetControllerReference(cephClient, secret, r.scheme)
+	if err != nil {
+		return errors.Wrapf(err, "failed to set owner reference to ceph client secret %q", secret.Name)
 	}
 
-	// Delete the secret if required
-	if cephClient.Spec.RemoveSecret {
-		if getSecretErr == nil {
-			return k8sutil.DeleteSecretIfOwnedBy(r.clusterInfo.Context, r.context.Clientset,
-				secret.Name, secret.Namespace, *metav1.GetControllerOf(secret))
+	// Create or Update Kubernetes Secret
+	_, err = r.context.Clientset.CoreV1().Secrets(cephClient.Namespace).Get(r.clusterInfo.Context, secret.Name, metav1.GetOptions{})
+	if err != nil {
+		if kerrors.IsNotFound(err) {
+			logger.Debugf("creating secret for %q", secret.Name)
+			if _, err := r.context.Clientset.CoreV1().Secrets(cephClient.Namespace).Create(r.clusterInfo.Context, secret, metav1.CreateOptions{}); err != nil {
+				return errors.Wrapf(err, "failed to create secret for %q", secret.Name)
+			}
+			logger.Infof("created client %q", cephClient.Name)
+			return nil
 		}
-		return nil
+		return errors.Wrapf(err, "failed to get secret for %q", secret.Name)
 	}
-
-	if kerrors.IsNotFound(getSecretErr) {
-		logger.Debugf("creating secret %q", secret.Namespace+"/"+secret.Name)
-		if _, err := r.context.Clientset.CoreV1().
-			Secrets(secret.Namespace).Create(r.clusterInfo.Context, secret, metav1.CreateOptions{}); err != nil {
-			return errors.Wrapf(err, "failed to create secret %q", secret.Name)
-		}
-		logger.Infof("created secret for CephClient %q", cephClient.Namespace+"/"+cephClient.Name)
-		return nil
+	logger.Debugf("updating secret for %s", secret.Name)
+	_, err = r.context.Clientset.CoreV1().Secrets(cephClient.Namespace).Update(r.clusterInfo.Context, secret, metav1.UpdateOptions{})
+	if err != nil {
+		return errors.Wrapf(err, "failed to update secret for %q", secret.Name)
 	}
 
-	return k8sutil.UpdateSecretIfOwnedBy(r.clusterInfo.Context, r.context.Clientset, secret)
+	logger.Infof("updated client %q", cephClient.Name)
+	return nil
 }
 
 // Delete the client
@@ -405,17 +394,10 @@ func (r *ReconcileCephClient) updateStatus(observedGeneration int64, name types.
 
 func generateStatusInfo(client *cephv1.CephClient) map[string]string {
 	m := make(map[string]string)
-	// Set only if the secret is managed by the client
-	if !client.Spec.RemoveSecret {
-		m["secretName"] = generateCephUserSecretName(client)
-	}
-
+	m["secretName"] = generateCephUserSecretName(client)
 	return m
 }
 
 func generateCephUserSecretName(client *cephv1.CephClient) string {
-	if client.Spec.SecretName != "" {
-		return client.Spec.SecretName // return the secret name as requested by user.
-	}
 	return fmt.Sprintf("rook-ceph-client-%s", client.Name)
 }
diff --git a/pkg/operator/ceph/cluster/nodedaemon/exporter.go b/pkg/operator/ceph/cluster/nodedaemon/exporter.go
index cc72c34d8..987a49d43 100644
--- a/pkg/operator/ceph/cluster/nodedaemon/exporter.go
+++ b/pkg/operator/ceph/cluster/nodedaemon/exporter.go
@@ -121,7 +121,7 @@ func (r *ReconcileNode) createOrUpdateCephExporter(node corev1.Node, tolerations
 		// wait for previous exporter pod to be deleted, before creating a new one
 		// to avoid fighting for the same socket file
 		deploy.Spec.Strategy.Type = appsv1.RecreateDeploymentStrategyType
-		hostNetwork := exporterIsHost(cephCluster)
+
 		var terminationGracePeriodSeconds int64 = 2
 		deploy.Spec.Template = corev1.PodTemplateSpec{
 			ObjectMeta: metav1.ObjectMeta{
@@ -137,7 +137,7 @@ func (r *ReconcileNode) createOrUpdateCephExporter(node corev1.Node, tolerations
 				},
 				Tolerations:                   tolerations,
 				RestartPolicy:                 corev1.RestartPolicyAlways,
-				HostNetwork:                   hostNetwork,
+				HostNetwork:                   cephCluster.Spec.Network.IsHost(),
 				Volumes:                       volumes,
 				PriorityClassName:             cephv1.GetCephExporterPriorityClassName(cephCluster.Spec.PriorityClassNames),
 				TerminationGracePeriodSeconds: &terminationGracePeriodSeconds,
@@ -308,11 +308,3 @@ func generateExporterEnvVar() corev1.EnvVar {
 
 	return env
 }
-
-func exporterIsHost(cephCluster cephv1.CephCluster) bool {
-	hostNetwork := cephCluster.Spec.Network.IsHost()
-	if cephCluster.Spec.Monitoring.Exporter != nil && cephCluster.Spec.Monitoring.Exporter.HostNetwork != nil {
-		hostNetwork = *cephCluster.Spec.Monitoring.Exporter.HostNetwork
-	}
-	return hostNetwork
-}
diff --git a/pkg/operator/ceph/cluster/osd/osd.go b/pkg/operator/ceph/cluster/osd/osd.go
index f352a9c86..f1aadf3dd 100644
--- a/pkg/operator/ceph/cluster/osd/osd.go
+++ b/pkg/operator/ceph/cluster/osd/osd.go
@@ -941,11 +941,15 @@ func (c *Cluster) deleteOSDDeployment(osdID int) error {
 	deploymentName := fmt.Sprintf("rook-ceph-osd-%d", osdID)
 	logger.Infof("removing the OSD deployment %q", deploymentName)
 	if err := k8sutil.DeleteDeployment(c.clusterInfo.Context, c.context.Clientset, c.clusterInfo.Namespace, deploymentName); err != nil {
-		if !kerrors.IsNotFound(err) {
-			return errors.Wrapf(err, "failed to delete OSD deployment %q.", deploymentName)
+		if err != nil {
+			if kerrors.IsNotFound(err) {
+				logger.Debugf("osd deployment %q not found. Ignoring since object must be deleted.", deploymentName)
+			} else {
+				return errors.Wrapf(err, "failed to delete OSD deployment %q.", deploymentName)
+			}
 		}
-		logger.Debugf("osd deployment %q not found. Ignoring since object must be deleted.", deploymentName)
 	}
+
 	return nil
 }
 
diff --git a/pkg/operator/ceph/cluster/osd/spec.go b/pkg/operator/ceph/cluster/osd/spec.go
index e484a9df6..0fdd7f040 100644
--- a/pkg/operator/ceph/cluster/osd/spec.go
+++ b/pkg/operator/ceph/cluster/osd/spec.go
@@ -111,6 +111,39 @@ KEYRING_FILE="$OSD_DATA_DIR"/keyring
 CV_MODE=%s
 DEVICE="$%s"
 
+# In rare cases keyring file created with prepare-osd but did not
+# being stored in ceph auth system therefore we need to import it
+# from keyring file instead of creating new one
+if ! ceph -n client.admin auth get osd."$OSD_ID" -k /etc/ceph/admin-keyring-store/keyring; then
+    if [ -f "$KEYRING_FILE" ]; then
+        # import keyring from existing file
+        TMP_DIR=$(mktemp -d)
+
+        python3 -c "
+import configparser
+
+config = configparser.ConfigParser()
+config.read('$KEYRING_FILE')
+
+if not config.has_section('osd.$OSD_ID'):
+    exit()
+
+config['osd.$OSD_ID'] = {'key': config['osd.$OSD_ID']['key'], 'caps mon': '\"allow profile osd\"', 'caps mgr': '\"allow profile osd\"', 'caps osd': '\"allow *\"'}
+
+with open('$TMP_DIR/keyring', 'w') as configfile:
+    config.write(configfile)
+"
+
+        cat "$TMP_DIR"/keyring
+        ceph -n client.admin auth import -i "$TMP_DIR"/keyring -k /etc/ceph/admin-keyring-store/keyring
+
+        rm --recursive --force "$TMP_DIR"
+    else
+        # create new keyring if no keyring file found
+        ceph -n client.admin auth get-or-create osd."$OSD_ID" mon 'allow profile osd' mgr 'allow profile osd' osd 'allow *' -k /etc/ceph/admin-keyring-store/keyring
+    fi
+fi
+
 # active the osd with ceph-volume
 if [[ "$CV_MODE" == "lvm" ]]; then
 	TMP_DIR=$(mktemp -d)
@@ -618,13 +651,6 @@ func (c *Cluster) makeDeployment(osdProps osdProperties, osd *OSDInfo, provision
 		initContainers = append(initContainers, c.getExpandInitContainer(osdProps, c.spec.DataDirHostPath, c.clusterInfo.Namespace, osdID, *osd))
 	}
 
-	// key update init container must go after activate
-	adminKeyVol, cephxContainer := c.getCephxKeyUpdateInitContainer(osdID, osdProps)
-	if !volumeExistsWithName(volumes, adminKeyVol.Name) {
-		volumes = append(volumes, adminKeyVol)
-	}
-	initContainers = append(initContainers, cephxContainer)
-
 	// Doing a chown in a post start lifecycle hook does not reliably complete before the OSD
 	// process starts, which can cause the pod to fail without the lifecycle hook's chown command
 	// completing. It can take an arbitrarily long time for a pod restart to successfully chown the
@@ -1404,83 +1430,6 @@ func (c *Cluster) getEncryptedStatusPVCInitContainer(mountPath string, osdProps
 	}
 }
 
-// init container to get (or create, if needed) the most up-to-date keyring for the given OSD and
-// update the OSD config directory keyring file. this allows OSD cephx keys to be rotated without
-// causing OSD pod crash loops.
-//
-// this must come after OSD activate init container because 'ceph-bluestore-tool' (and consequently,
-// 'ceph-volume activate') pulls the keyring from the OSD disk's bluestore data and overwrites the
-// config dir's keyring file, even when the on-disk key is not the most up-to-date.
-func (c *Cluster) getCephxKeyUpdateInitContainer(osdID string, osdProps osdProperties) (v1.Volume, v1.Container) {
-	volMounts := []v1.VolumeMount{
-		{Name: k8sutil.ConfigOverrideName, ReadOnly: true, MountPath: opconfig.EtcCephDir},
-	}
-
-	adminKeyringVol, adminKeyringVolMount := cephkey.Volume().Admin(), cephkey.VolumeMount().Admin()
-	volMounts = append(volMounts, adminKeyringVolMount)
-
-	// OSD config dir is at /var/lib/ceph/osd/ceph-<id>
-	osdConfigMountPath := activateOSDMountPath + osdID
-
-	if osdProps.onPVC() {
-		// assumption: bridge vol will already be added to pod spec for PVC OSDs
-		volMounts = append(volMounts, getPvcOSDBridgeMountActivate(osdConfigMountPath, osdProps.pvc.ClaimName))
-	} else {
-		// assumption: activate OSD volume will already be added to pod spec for non-PVC OSDs at the
-		// correct location for mounting to /var/lib/ceph/osd/ceph-<id>
-		volMounts = append(volMounts,
-			v1.VolumeMount{Name: activateOSDVolumeName, MountPath: osdConfigMountPath},
-		)
-	}
-
-	keyUpdateScript := `
-set -o errexit
-set -o nounset
-set -o pipefail
-set -o xtrace
-
-OSD_ID="` + osdID + `"
-KEYRING_FILE=/var/lib/ceph/osd/ceph-"${OSD_ID}"/keyring
-
-ceph --name client.admin auth get-or-create osd."${OSD_ID}" \
-  mon 'allow profile osd' mgr 'allow profile osd' osd 'allow *' \
-  --keyring /etc/ceph/admin-keyring-store/keyring > "$KEYRING_FILE"
-`
-
-	envVars := []v1.EnvVar{
-		{
-			Name: "ROOK_CEPH_MON_HOST",
-			ValueFrom: &v1.EnvVarSource{
-				SecretKeyRef: &v1.SecretKeySelector{
-					LocalObjectReference: v1.LocalObjectReference{
-						Name: "rook-ceph-config",
-					},
-					Key: "mon_host",
-				},
-			},
-		},
-		{Name: "CEPH_ARGS", Value: "--mon-host=$(ROOK_CEPH_MON_HOST)"},
-	}
-
-	container := v1.Container{
-		Command: []string{
-			"/bin/bash",
-			"-c",
-			keyUpdateScript,
-		},
-		Name:            "cephx-keyring-update",
-		Image:           c.spec.CephVersion.Image,
-		ImagePullPolicy: controller.GetContainerImagePullPolicy(c.spec.CephVersion.ImagePullPolicy),
-		VolumeMounts:    volMounts,
-		SecurityContext: controller.PrivilegedContext(true),
-		Env:             envVars,
-		EnvFrom:         getEnvFromSources(),
-		Resources:       osdProps.resources,
-	}
-
-	return adminKeyringVol, container
-}
-
 func (c *Cluster) getOSDContainerPorts() []v1.ContainerPort {
 	var ports []v1.ContainerPort
 	if c.spec.RequireMsgr2() {
@@ -1546,12 +1495,3 @@ func getOSDCmd(cmd []string, interval int) []string {
 	}
 	return cmd
 }
-
-func volumeExistsWithName(vols []v1.Volume, name string) bool {
-	for _, v := range vols {
-		if v.Name == name {
-			return true
-		}
-	}
-	return false
-}
diff --git a/pkg/operator/ceph/csi/cluster_config.go b/pkg/operator/ceph/csi/cluster_config.go
index b4531ff6f..76c958a22 100644
--- a/pkg/operator/ceph/csi/cluster_config.go
+++ b/pkg/operator/ceph/csi/cluster_config.go
@@ -314,10 +314,6 @@ func updateCsiConfigMapOwnerRefs(ctx context.Context, namespace string, clientse
 // CephFilesystemSubVolumeGroup) or for other supplementary entries, the clusterID should be unique
 // and different from the namespace so as not to disrupt CephCluster configurations.
 func SaveClusterConfig(clientset kubernetes.Interface, clusterID, clusterNamespace string, clusterInfo *cephclient.ClusterInfo, newCsiClusterConfigEntry *CSIClusterConfigEntry) error {
-	if EnableCSIOperator() {
-		logger.Debugf("csi-operator is enabled no need to save/update csi config in configmap %q", configName)
-		return nil
-	}
 	// csi is deployed into the same namespace as the operator
 	csiNamespace := os.Getenv(k8sutil.PodNamespaceEnvVar)
 	if csiNamespace == "" {
@@ -395,11 +391,6 @@ func updateCSIDriverOptions(curr, clusterKey string,
 // SaveCSIDriverOptions, similar to SaveClusterConfig, updates the config map used by ceph-csi
 // with CSI driver options such as read affinity, kernel mount options and fuse mount options.
 func SaveCSIDriverOptions(clientset kubernetes.Interface, clusterNamespace string, clusterInfo *cephclient.ClusterInfo) error {
-	if EnableCSIOperator() {
-		logger.Debugf("csi-operator is enabled no need to save/update csi config in configmap %q", configName)
-		return nil
-	}
-
 	// csi is deployed into the same namespace as the operator
 	csiNamespace := os.Getenv(k8sutil.PodNamespaceEnvVar)
 	if csiNamespace == "" {
diff --git a/pkg/operator/ceph/csi/secrets.go b/pkg/operator/ceph/csi/secrets.go
index 0de1e2782..1f534dc4e 100644
--- a/pkg/operator/ceph/csi/secrets.go
+++ b/pkg/operator/ceph/csi/secrets.go
@@ -17,8 +17,6 @@ limitations under the License.
 package csi
 
 import (
-	"fmt"
-
 	"github.com/pkg/errors"
 	"github.com/rook/rook/pkg/clusterd"
 	"github.com/rook/rook/pkg/daemon/ceph/client"
@@ -174,13 +172,6 @@ func createOrUpdateCSISecret(clusterInfo *client.ClusterInfo, csiRBDProvisionerS
 
 // CreateCSISecrets creates all the Kubernetes CSI Secrets
 func CreateCSISecrets(context *clusterd.Context, clusterInfo *client.ClusterInfo) error {
-	if clusterInfo.CSIDriverSpec.SkipUserCreation {
-		if err := deleteOwnedCSISecretsByCephCluster(context, clusterInfo); err != nil {
-			return err
-		}
-		logger.Info("CSI user creation is disabled; skipping user and secret creation")
-		return nil
-	}
 	k := keyring.GetSecretStore(context, clusterInfo, clusterInfo.OwnerInfo)
 
 	// Create CSI RBD Provisioner Ceph key
@@ -214,26 +205,3 @@ func CreateCSISecrets(context *clusterd.Context, clusterInfo *client.ClusterInfo
 
 	return nil
 }
-
-func deleteOwnedCSISecretsByCephCluster(context *clusterd.Context, clusterInfo *client.ClusterInfo) error {
-	ownerRef := metav1.OwnerReference{
-		APIVersion: "ceph.rook.io/v1",
-		Kind:       "CephCluster",
-		Name:       clusterInfo.NamespacedName().Name,
-	}
-	secrets := []string{CsiRBDNodeSecret, CsiRBDProvisionerSecret, CsiCephFSNodeSecret, CsiCephFSProvisionerSecret}
-	for _, secretName := range secrets {
-		err := k8sutil.DeleteSecretIfOwnedBy(
-			clusterInfo.Context,
-			context.Clientset,
-			secretName,
-			clusterInfo.Namespace,
-			ownerRef,
-		)
-		if err != nil {
-			return fmt.Errorf("failed to delete secret %q: %w", secretName, err)
-		}
-	}
-
-	return nil
-}
diff --git a/pkg/operator/ceph/csi/spec.go b/pkg/operator/ceph/csi/spec.go
index fd7bff7f9..25f307ae2 100644
--- a/pkg/operator/ceph/csi/spec.go
+++ b/pkg/operator/ceph/csi/spec.go
@@ -132,7 +132,7 @@ var (
 // manually challenging.
 var (
 	// image names
-	DefaultCSIPluginImage   = "quay.io/cephcsi/cephcsi:v3.14.1"
+	DefaultCSIPluginImage   = "quay.io/cephcsi/cephcsi:v3.14.0"
 	DefaultRegistrarImage   = "registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.13.0"
 	DefaultProvisionerImage = "registry.k8s.io/sig-storage/csi-provisioner:v5.2.0"
 	DefaultAttacherImage    = "registry.k8s.io/sig-storage/csi-attacher:v4.8.1"
diff --git a/pkg/operator/ceph/object/user/controller.go b/pkg/operator/ceph/object/user/controller.go
index dd3d03483..c39b3446a 100644
--- a/pkg/operator/ceph/object/user/controller.go
+++ b/pkg/operator/ceph/object/user/controller.go
@@ -315,7 +315,7 @@ func (r *ReconcileObjectStoreUser) reconcile(request reconcile.Request) (reconci
 
 	referencedSecrets := &map[types.UID]*corev1.Secret{}
 	// Set any provided key pair(s)
-	if cephObjectStoreUser.GetDeletionTimestamp().IsZero() && len(cephObjectStoreUser.Spec.Keys) > 0 {
+	if len(cephObjectStoreUser.Spec.Keys) > 0 {
 		var keys *[]admin.UserKeySpec
 		keys, referencedSecrets, err = r.generateUserKeySpec(cephObjectStoreUser)
 		if err != nil {
diff --git a/pkg/operator/k8sutil/secret.go b/pkg/operator/k8sutil/secret.go
index 2161d82e7..3a68ac4af 100644
--- a/pkg/operator/k8sutil/secret.go
+++ b/pkg/operator/k8sutil/secret.go
@@ -23,7 +23,6 @@ import (
 	v1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/client-go/kubernetes"
 )
 
@@ -46,99 +45,3 @@ func CreateOrUpdateSecret(ctx context.Context, clientset kubernetes.Interface, s
 	}
 	return s, err
 }
-
-// DeleteSecretIfOwnedBy deletes a Kubernetes Secret if its controller OwnerReference matches the provided owner.
-func DeleteSecretIfOwnedBy(ctx context.Context, clientset kubernetes.Interface, secretName, namespace string, owner metav1.OwnerReference) error {
-	secret, err := clientset.CoreV1().
-		Secrets(namespace).
-		Get(ctx, secretName, metav1.GetOptions{})
-	if errors.IsNotFound(err) {
-		return nil
-	}
-	if err != nil {
-		return fmt.Errorf("failed to get secret %s. %w", secretName, err)
-	}
-
-	secretOwner := metav1.GetControllerOf(secret)
-	if secretOwner == nil {
-		// if secret is unowned, assume it is user created and not own-able by Rook
-		return nil
-	}
-
-	if !IsSameOwnerReference(*secretOwner, owner) {
-		logger.Debugf("secret %q is already owned by %s %q, skipping deletion", secret.Namespace+"/"+secret.Name, secretOwner.Kind, secretOwner.Name)
-		return nil
-	}
-	// secret is owned by this ceph client remove it
-	err = clientset.CoreV1().
-		Secrets(secret.Namespace).
-		Delete(ctx, secret.Name, metav1.DeleteOptions{})
-	if err != nil && !errors.IsNotFound(err) {
-		return fmt.Errorf("failed to delete secret %s. %w", secret.Name, err)
-	}
-	logger.Infof("removed secret %q", secret.Namespace+"/"+secret.Name)
-
-	return nil
-}
-
-// UpdateSecretIfOwnedBy fetches the latest version of the given Secret from the cluster,
-// verifies controller ownership, applies any in-memory modifications from the input secret,
-// and updates it if ownership matches.
-func UpdateSecretIfOwnedBy(ctx context.Context, clientset kubernetes.Interface, secret *v1.Secret) error {
-	// Fetch latest version of the secret
-	existingSecret, err := clientset.CoreV1().
-		Secrets(secret.Namespace).
-		Get(ctx, secret.Name, metav1.GetOptions{})
-	if err != nil {
-		return fmt.Errorf("failed to fetch secret %q: %w", secret.Name, err)
-	}
-
-	// Check controller ownership
-	existingSecretOwner := metav1.GetControllerOf(existingSecret)
-	if existingSecretOwner == nil {
-		// Secret is unowned
-		return fmt.Errorf("no owner founf on secret %q", existingSecret.Namespace+"/"+existingSecret.Name)
-	}
-
-	secretOwner := metav1.GetControllerOf(secret)
-	if secretOwner == nil {
-		return fmt.Errorf("the ownerReference is not set on %q", secret.Name)
-	}
-
-	if !IsSameOwnerReference(*existingSecretOwner, *secretOwner) {
-		return fmt.Errorf("secret %q is already owned by %s %q", existingSecret.Namespace+"/"+existingSecret.Name, secretOwner.Kind, secretOwner.Name)
-	}
-
-	// Apply input from the secret to the existingSecret
-	existingSecret.Data = secret.Data
-	existingSecret.StringData = secret.StringData
-	existingSecret.Labels = secret.Labels
-	existingSecret.Annotations = secret.Annotations
-
-	// Update the secret
-	_, err = clientset.CoreV1().
-		Secrets(existingSecret.Namespace).
-		Update(ctx, existingSecret, metav1.UpdateOptions{})
-	if err != nil {
-		return fmt.Errorf("failed to update secret %q: %w", existingSecret.Name, err)
-	}
-
-	logger.Infof("updated secret %q", existingSecret.Namespace+"/"+existingSecret.Name)
-	return nil
-}
-
-// IsSameOwnerReference returns true if the two OwnerReferences refer to the same Kubernetes resource.
-// It compares Group, Kind, and Name fields. It ignores the UID field.
-func IsSameOwnerReference(ownerRef, resourceRef metav1.OwnerReference) bool {
-	ownerRefGroupVersion, err := schema.ParseGroupVersion(ownerRef.APIVersion)
-	if err != nil {
-		return false
-	}
-	resourceGroupVersion, err := schema.ParseGroupVersion(resourceRef.APIVersion)
-	if err != nil {
-		return false
-	}
-	return ownerRefGroupVersion.Group == resourceGroupVersion.Group &&
-		ownerRef.Kind == resourceRef.Kind &&
-		ownerRef.Name == resourceRef.Name
-}


Test patch:
diff --git a/.github/workflows/integration-test-helm-suite.yaml b/.github/workflows/integration-test-helm-suite.yaml
index 6cd4c0b88..09ed265c2 100644
--- a/.github/workflows/integration-test-helm-suite.yaml
+++ b/.github/workflows/integration-test-helm-suite.yaml
@@ -28,8 +28,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        helm-version: ["v3.13.3", "v3.18.3"]
-        kubernetes-versions: ["v1.33.0"]
+        kubernetes-versions: ["v1.28.15", "v1.33.0"]
     steps:
       - name: checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -39,7 +38,7 @@ jobs:
       - name: Set up Helm
         uses: azure/setup-helm@b9e51907a09c216f16ebe8536097933489208112 # v4.3.0
         with:
-          version: ${{ matrix.helm-version }}
+          version: v3.18.2
 
       - name: consider debugging
         uses: ./.github/workflows/tmate_debug
diff --git a/.github/workflows/unit-test.yml b/.github/workflows/unit-test.yml
index 86aadd022..a61cc0fca 100644
--- a/.github/workflows/unit-test.yml
+++ b/.github/workflows/unit-test.yml
@@ -46,7 +46,7 @@ jobs:
           go-version: "1.23"
 
       - name: Setup jq
-        uses: dcarbone/install-jq-action@b7ef57d46ece78760b4019dbc4080a1ba2a40b45 # v3.2.0
+        uses: dcarbone/install-jq-action@f0e10f46ff84f4d32178b4b76e1ef180b16f82c3 # v3.1.1
         with:
           version: "${{ inputs.version }}"
 
diff --git a/pkg/operator/ceph/client/controller_test.go b/pkg/operator/ceph/client/controller_test.go
index 89f3eda85..0a04e1875 100644
--- a/pkg/operator/ceph/client/controller_test.go
+++ b/pkg/operator/ceph/client/controller_test.go
@@ -27,17 +27,14 @@ import (
 	rookclient "github.com/rook/rook/pkg/client/clientset/versioned/fake"
 	"github.com/rook/rook/pkg/client/clientset/versioned/scheme"
 	"github.com/rook/rook/pkg/clusterd"
-	cephclient "github.com/rook/rook/pkg/daemon/ceph/client"
 	"github.com/rook/rook/pkg/operator/k8sutil"
 	testop "github.com/rook/rook/pkg/operator/test"
 	exectest "github.com/rook/rook/pkg/util/exec/test"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/types"
-	k8sfake "k8s.io/client-go/kubernetes/fake"
 	"k8s.io/client-go/tools/record"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
@@ -315,223 +312,5 @@ func TestBuildUpdateStatusInfo(t *testing.T) {
 
 	statusInfo := generateStatusInfo(cephClient)
 	assert.NotEmpty(t, statusInfo["secretName"])
-	assert.Equal(t, generateCephUserSecretName(cephClient), statusInfo["secretName"])
-}
-
-func TestRemoveSecretUpdateStatusInfo(t *testing.T) {
-	cephClient := &cephv1.CephClient{
-		ObjectMeta: metav1.ObjectMeta{
-			Name: "client-ocp",
-		},
-		Spec: cephv1.ClientSpec{
-			RemoveSecret: true,
-		},
-	}
-
-	statusInfo := generateStatusInfo(cephClient)
-	assert.Empty(t, statusInfo)
-}
-
-func TestCustomSecretname(t *testing.T) {
-	secretName := "test-secret"
-	cephClient := &cephv1.CephClient{
-		ObjectMeta: metav1.ObjectMeta{
-			Name: "client-ocp",
-		},
-		Spec: cephv1.ClientSpec{
-			SecretName: secretName,
-		},
-	}
-
-	statusInfo := generateStatusInfo(cephClient)
-	assert.NotEmpty(t, statusInfo["secretName"])
-	assert.Equal(t, secretName, statusInfo["secretName"])
-}
-
-func TestReconcileCephClient_reconcileCephClientSecret(t *testing.T) {
-	ownerController := true
-	tests := []struct {
-		name           string
-		removeSecret   bool
-		existingSecret *v1.Secret
-		expectDelete   bool
-		expectCreate   bool
-		expectUpdate   bool
-		expectError    bool
-	}{
-		{
-			name:         "delete if removeSecret is set and owned by same cephClient",
-			removeSecret: true,
-			existingSecret: &v1.Secret{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      "test-secret",
-					Namespace: "rook-ceph",
-					OwnerReferences: []metav1.OwnerReference{{
-						APIVersion: "ceph.rook.io/v1",
-						Kind:       "CephClient",
-						Name:       "test-client",
-						Controller: &ownerController,
-					}},
-				},
-			},
-			expectDelete: true,
-		},
-		{
-			name:         "skip delete if not owned by the current cephClient",
-			removeSecret: true,
-			existingSecret: &v1.Secret{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      "client.test",
-					Namespace: "rook-ceph",
-					OwnerReferences: []metav1.OwnerReference{{
-						APIVersion: "ceph.rook.io/v1",
-						Kind:       "CephClient",
-						Name:       "another-client",
-						Controller: &ownerController,
-					}},
-				},
-			},
-			expectDelete: false,
-		},
-		{
-			name:           "create if secret not found",
-			removeSecret:   false,
-			existingSecret: nil,
-			expectCreate:   true,
-		},
-		{
-			name:         "update the secret if owned by the cephClient",
-			removeSecret: false,
-			existingSecret: &v1.Secret{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:            "test-secret",
-					Namespace:       "rook-ceph",
-					ResourceVersion: "123",
-					OwnerReferences: []metav1.OwnerReference{{
-						APIVersion: "ceph.rook.io/v1",
-						Kind:       "CephClient",
-						Name:       "test-client",
-						Controller: &ownerController,
-					}},
-				},
-			},
-			expectUpdate: true,
-		},
-		{
-			name:         "error if another ceph client is owned and removeSecret is set",
-			removeSecret: false,
-			existingSecret: &v1.Secret{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      "test-secret",
-					Namespace: "rook-ceph",
-					OwnerReferences: []metav1.OwnerReference{{
-						APIVersion: "ceph.rook.io/v1",
-						Kind:       "CephClient",
-						Name:       "another-client",
-						Controller: &ownerController,
-					}},
-				},
-			},
-			expectError: true,
-		},
-		{
-			name:         "update the secret if owned by another resource",
-			removeSecret: false,
-			existingSecret: &v1.Secret{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:            "test-secret",
-					Namespace:       "rook-ceph",
-					ResourceVersion: "123",
-					OwnerReferences: []metav1.OwnerReference{{
-						APIVersion: "ceph.rook.io/v1",
-						Kind:       "CephCluster",
-						Name:       "test-cluster",
-						Controller: &ownerController,
-					}},
-				},
-			},
-			expectError: true,
-		},
-		{
-			name:         "update the secret if there is no owner",
-			removeSecret: false,
-			existingSecret: &v1.Secret{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:            "test-secret",
-					Namespace:       "rook-ceph",
-					ResourceVersion: "123",
-				},
-			},
-			expectUpdate: false,
-			expectError:  true,
-		},
-		{
-			name:           "secret already deleted and removeSecret is set",
-			removeSecret:   true,
-			existingSecret: nil,
-			expectDelete:   true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			client := k8sfake.NewSimpleClientset()
-			scheme := runtime.NewScheme()
-			assert.NoError(t, cephv1.AddToScheme(scheme))
-			r := &ReconcileCephClient{
-				context: &clusterd.Context{
-					Clientset: client,
-				},
-				scheme: scheme,
-				clusterInfo: &cephclient.ClusterInfo{
-					Context: context.TODO(),
-				},
-			}
-
-			cephClient := &cephv1.CephClient{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      "test-client",
-					Namespace: "rook-ceph",
-				},
-				TypeMeta: metav1.TypeMeta{
-					APIVersion: "ceph.rook.io/v1",
-					Kind:       "CephClient",
-				},
-				Spec: cephv1.ClientSpec{
-					RemoveSecret: tt.removeSecret,
-				},
-			}
-
-			secret := &v1.Secret{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      "test-secret",
-					Namespace: "rook-ceph",
-				},
-				StringData: map[string]string{"foo": "bar"},
-			}
-
-			if tt.existingSecret != nil {
-				_, err := client.CoreV1().Secrets("rook-ceph").Create(context.TODO(), tt.existingSecret, metav1.CreateOptions{})
-				require.NoError(t, err)
-			}
-
-			err := r.reconcileCephClientSecret(cephClient, secret)
-			if tt.expectError {
-				assert.Error(t, err)
-			} else {
-				assert.NoError(t, err)
-			}
-
-			secrets, _ := client.CoreV1().Secrets("rook-ceph").List(context.TODO(), metav1.ListOptions{})
-			if tt.expectDelete {
-				assert.Empty(t, secrets.Items)
-			}
-			if tt.expectCreate {
-				assert.Len(t, secrets.Items, 1)
-			}
-			if tt.expectUpdate {
-				assert.Equal(t, "bar", secrets.Items[0].StringData["foo"])
-			}
-		})
-	}
+	assert.Equal(t, "rook-ceph-client-client-ocp", statusInfo["secretName"])
 }
diff --git a/pkg/operator/ceph/cluster/nodedaemon/exporter_test.go b/pkg/operator/ceph/cluster/nodedaemon/exporter_test.go
index 3109345a2..4579f2cdd 100644
--- a/pkg/operator/ceph/cluster/nodedaemon/exporter_test.go
+++ b/pkg/operator/ceph/cluster/nodedaemon/exporter_test.go
@@ -19,7 +19,6 @@ package nodedaemon
 import (
 	"context"
 	"fmt"
-	"strconv"
 	"testing"
 
 	monitoringv1 "github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1"
@@ -35,7 +34,6 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/utils/ptr"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 )
@@ -47,7 +45,6 @@ func assertCephExporterArgs(t *testing.T, args []string, ipv6 bool) {
 	} else {
 		expectedArgsLen = 8
 	}
-
 	argsLen := len(args)
 	assert.Equal(t, expectedArgsLen, argsLen)
 	assert.Equal(t, "--sock-dir", args[0])
@@ -147,192 +144,34 @@ func TestCreateOrUpdateCephExporter(t *testing.T) {
 }
 
 func TestCephExporterBindAddress(t *testing.T) {
-	prioLimit, statsPeriod := defaultPrioLimit, defaultStatsPeriod
-	prioLimitString, err := strconv.ParseInt(prioLimit, 10, 64)
-	assert.NoError(t, err, "failed to parse prioLimit")
-	statsPeriodString, err := strconv.ParseInt(statsPeriod, 10, 64)
-	assert.NoError(t, err, "failed to parse statsPeriod")
-
-	// Test cases for exporterHostNetwork is not set and cephCluster.Spec.Network.HostNetwork=true
-	t.Run("IPv4 and exporterHostNetwork is not set and cephCluster.Spec.Network.HostNetwork=true", func(t *testing.T) {
+	t.Run("IPv4", func(t *testing.T) {
 		cephCluster := cephv1.CephCluster{ObjectMeta: metav1.ObjectMeta{Namespace: "rook-ceph"}}
 		cephCluster.Spec.Labels = cephv1.LabelsSpec{}
 		cephCluster.Spec.PriorityClassNames = cephv1.PriorityClassNamesSpec{}
 		cephVersion := cephver.CephVersion{Major: 18, Minor: 0, Extra: 0}
 
-		cephCluster.Spec.Network.HostNetwork = true
-
 		exporterContainer := getCephExporterDaemonContainer(cephCluster, cephVersion)
 		assertCephExporterArgs(t, exporterContainer.Args, false)
 	})
 
-	t.Run("IPv6 via DualStack and exporterHostNetwork is not set and cephCluster.Spec.Network.HostNetwork=true", func(t *testing.T) {
+	t.Run("IPv6 via DualStack", func(t *testing.T) {
 		cephCluster := cephv1.CephCluster{ObjectMeta: metav1.ObjectMeta{Namespace: "rook-ceph"}}
 		cephCluster.Spec.Labels = cephv1.LabelsSpec{}
 		cephCluster.Spec.PriorityClassNames = cephv1.PriorityClassNamesSpec{}
 		cephCluster.Spec.Network.DualStack = true
 		cephVersion := cephver.CephVersion{Major: 18, Minor: 0, Extra: 0}
 
-		cephCluster.Spec.Network.HostNetwork = true
-
 		exporterContainer := getCephExporterDaemonContainer(cephCluster, cephVersion)
 		assertCephExporterArgs(t, exporterContainer.Args, true)
 	})
 
-	t.Run("IPv6 via IPFamily and exporterHostNetwork is not set and cephCluster.Spec.Network.HostNetwork=true", func(t *testing.T) {
+	t.Run("IPv6 via IPFamily", func(t *testing.T) {
 		cephCluster := cephv1.CephCluster{ObjectMeta: metav1.ObjectMeta{Namespace: "rook-ceph"}}
 		cephCluster.Spec.Labels = cephv1.LabelsSpec{}
 		cephCluster.Spec.PriorityClassNames = cephv1.PriorityClassNamesSpec{}
 		cephCluster.Spec.Network.IPFamily = "IPv6"
 		cephVersion := cephver.CephVersion{Major: 18, Minor: 0, Extra: 0}
 
-		cephCluster.Spec.Network.HostNetwork = true
-
-		exporterContainer := getCephExporterDaemonContainer(cephCluster, cephVersion)
-		assertCephExporterArgs(t, exporterContainer.Args, true)
-	})
-
-	// Test cases for exporterHostNetwork is not set and cephCluster.Spec.Network.HostNetwork=false
-	t.Run("IPv4 and exporterHostNetwork is not set and cephCluster.Spec.Network.HostNetwork=true", func(t *testing.T) {
-		cephCluster := cephv1.CephCluster{ObjectMeta: metav1.ObjectMeta{Namespace: "rook-ceph"}}
-		cephCluster.Spec.Labels = cephv1.LabelsSpec{}
-		cephCluster.Spec.PriorityClassNames = cephv1.PriorityClassNamesSpec{}
-		cephVersion := cephver.CephVersion{Major: 18, Minor: 0, Extra: 0}
-
-		cephCluster.Spec.Network.HostNetwork = false
-
-		exporterContainer := getCephExporterDaemonContainer(cephCluster, cephVersion)
-		assertCephExporterArgs(t, exporterContainer.Args, false)
-	})
-
-	t.Run("IPv6 via DualStack and exporterHostNetwork is not set and cephCluster.Spec.Network.HostNetwork=false", func(t *testing.T) {
-		cephCluster := cephv1.CephCluster{ObjectMeta: metav1.ObjectMeta{Namespace: "rook-ceph"}}
-		cephCluster.Spec.Labels = cephv1.LabelsSpec{}
-		cephCluster.Spec.PriorityClassNames = cephv1.PriorityClassNamesSpec{}
-		cephCluster.Spec.Network.DualStack = true
-		cephVersion := cephver.CephVersion{Major: 18, Minor: 0, Extra: 0}
-
-		cephCluster.Spec.Network.HostNetwork = false
-
-		exporterContainer := getCephExporterDaemonContainer(cephCluster, cephVersion)
-		assertCephExporterArgs(t, exporterContainer.Args, true)
-	})
-
-	t.Run("IPv6 via IPFamily and exporterHostNetwork is not set and cephCluster.Spec.Network.HostNetwork=false", func(t *testing.T) {
-		cephCluster := cephv1.CephCluster{ObjectMeta: metav1.ObjectMeta{Namespace: "rook-ceph"}}
-		cephCluster.Spec.Labels = cephv1.LabelsSpec{}
-		cephCluster.Spec.PriorityClassNames = cephv1.PriorityClassNamesSpec{}
-		cephCluster.Spec.Network.IPFamily = "IPv6"
-		cephVersion := cephver.CephVersion{Major: 18, Minor: 0, Extra: 0}
-
-		cephCluster.Spec.Network.HostNetwork = false
-
-		exporterContainer := getCephExporterDaemonContainer(cephCluster, cephVersion)
-		assertCephExporterArgs(t, exporterContainer.Args, true)
-	})
-
-	// Test cases for exporterHostNetwork=false and cephCluster.Spec.Network.HostNetwork=true
-	t.Run("IPv4 and exporterHostNetwork=false and cephCluster.Spec.Network.HostNetwork=true", func(t *testing.T) {
-		cephCluster := cephv1.CephCluster{ObjectMeta: metav1.ObjectMeta{Namespace: "rook-ceph"}}
-		cephCluster.Spec.Labels = cephv1.LabelsSpec{}
-		cephCluster.Spec.PriorityClassNames = cephv1.PriorityClassNamesSpec{}
-		cephVersion := cephver.CephVersion{Major: 18, Minor: 0, Extra: 0}
-
-		cephCluster.Spec.Monitoring.Exporter = &cephv1.CephExporterSpec{}
-		cephCluster.Spec.Monitoring.Exporter.HostNetwork = ptr.To(false)
-		cephCluster.Spec.Monitoring.Exporter.PerfCountersPrioLimit = prioLimitString
-		cephCluster.Spec.Monitoring.Exporter.StatsPeriodSeconds = statsPeriodString
-
-		cephCluster.Spec.Network.HostNetwork = true
-
-		exporterContainer := getCephExporterDaemonContainer(cephCluster, cephVersion)
-		assertCephExporterArgs(t, exporterContainer.Args, false)
-	})
-
-	t.Run("IPv6 via DualStack and exporterHostNetwork=false and cephCluster.Spec.Network.HostNetwork=true", func(t *testing.T) {
-		cephCluster := cephv1.CephCluster{ObjectMeta: metav1.ObjectMeta{Namespace: "rook-ceph"}}
-		cephCluster.Spec.Labels = cephv1.LabelsSpec{}
-		cephCluster.Spec.PriorityClassNames = cephv1.PriorityClassNamesSpec{}
-		cephCluster.Spec.Network.DualStack = true
-		cephVersion := cephver.CephVersion{Major: 18, Minor: 0, Extra: 0}
-
-		cephCluster.Spec.Monitoring.Exporter = &cephv1.CephExporterSpec{}
-		cephCluster.Spec.Monitoring.Exporter.HostNetwork = ptr.To(false)
-		cephCluster.Spec.Monitoring.Exporter.PerfCountersPrioLimit = prioLimitString
-		cephCluster.Spec.Monitoring.Exporter.StatsPeriodSeconds = statsPeriodString
-
-		cephCluster.Spec.Network.HostNetwork = true
-
-		exporterContainer := getCephExporterDaemonContainer(cephCluster, cephVersion)
-		assertCephExporterArgs(t, exporterContainer.Args, true)
-	})
-	t.Run("IPv6 via IPFamily and exporterHostNetwork=false and cephCluster.Spec.Network.HostNetwork=true", func(t *testing.T) {
-		cephCluster := cephv1.CephCluster{ObjectMeta: metav1.ObjectMeta{Namespace: "rook-ceph"}}
-		cephCluster.Spec.Labels = cephv1.LabelsSpec{}
-		cephCluster.Spec.PriorityClassNames = cephv1.PriorityClassNamesSpec{}
-		cephCluster.Spec.Network.IPFamily = "IPv6"
-		cephVersion := cephver.CephVersion{Major: 18, Minor: 0, Extra: 0}
-
-		cephCluster.Spec.Monitoring.Exporter = &cephv1.CephExporterSpec{}
-		cephCluster.Spec.Monitoring.Exporter.HostNetwork = ptr.To(false)
-		cephCluster.Spec.Monitoring.Exporter.PerfCountersPrioLimit = prioLimitString
-		cephCluster.Spec.Monitoring.Exporter.StatsPeriodSeconds = statsPeriodString
-
-		cephCluster.Spec.Network.HostNetwork = true
-
-		exporterContainer := getCephExporterDaemonContainer(cephCluster, cephVersion)
-		assertCephExporterArgs(t, exporterContainer.Args, true)
-	})
-
-	// Test cases for exporterHostNetwork=false and cephCluster.Spec.Network.HostNetwork=false
-	t.Run("IPv4 and exporterHostNetwork=false and cephCluster.Spec.Network.HostNetwork=false", func(t *testing.T) {
-		cephCluster := cephv1.CephCluster{ObjectMeta: metav1.ObjectMeta{Namespace: "rook-ceph"}}
-		cephCluster.Spec.Labels = cephv1.LabelsSpec{}
-		cephCluster.Spec.PriorityClassNames = cephv1.PriorityClassNamesSpec{}
-		cephVersion := cephver.CephVersion{Major: 18, Minor: 0, Extra: 0}
-
-		cephCluster.Spec.Monitoring.Exporter = &cephv1.CephExporterSpec{}
-		cephCluster.Spec.Monitoring.Exporter.HostNetwork = ptr.To(false)
-		cephCluster.Spec.Monitoring.Exporter.PerfCountersPrioLimit = prioLimitString
-		cephCluster.Spec.Monitoring.Exporter.StatsPeriodSeconds = statsPeriodString
-
-		cephCluster.Spec.Network.HostNetwork = false
-
-		exporterContainer := getCephExporterDaemonContainer(cephCluster, cephVersion)
-		assertCephExporterArgs(t, exporterContainer.Args, false)
-	})
-
-	t.Run("IPv6 via DualStack and exporterHostNetwork=false and cephCluster.Spec.Network.HostNetwork=false", func(t *testing.T) {
-		cephCluster := cephv1.CephCluster{ObjectMeta: metav1.ObjectMeta{Namespace: "rook-ceph"}}
-		cephCluster.Spec.Labels = cephv1.LabelsSpec{}
-		cephCluster.Spec.PriorityClassNames = cephv1.PriorityClassNamesSpec{}
-		cephCluster.Spec.Network.DualStack = true
-		cephVersion := cephver.CephVersion{Major: 18, Minor: 0, Extra: 0}
-
-		cephCluster.Spec.Monitoring.Exporter = &cephv1.CephExporterSpec{}
-		cephCluster.Spec.Monitoring.Exporter.HostNetwork = ptr.To(false)
-		cephCluster.Spec.Monitoring.Exporter.PerfCountersPrioLimit = prioLimitString
-		cephCluster.Spec.Monitoring.Exporter.StatsPeriodSeconds = statsPeriodString
-
-		cephCluster.Spec.Network.HostNetwork = false
-
-		exporterContainer := getCephExporterDaemonContainer(cephCluster, cephVersion)
-		assertCephExporterArgs(t, exporterContainer.Args, true)
-	})
-	t.Run("IPv6 via IPFamily and HostNetwork=false and cephCluster.Spec.Network.HostNetwork=false", func(t *testing.T) {
-		cephCluster := cephv1.CephCluster{ObjectMeta: metav1.ObjectMeta{Namespace: "rook-ceph"}}
-		cephCluster.Spec.Labels = cephv1.LabelsSpec{}
-		cephCluster.Spec.PriorityClassNames = cephv1.PriorityClassNamesSpec{}
-		cephCluster.Spec.Network.IPFamily = "IPv6"
-		cephVersion := cephver.CephVersion{Major: 18, Minor: 0, Extra: 0}
-
-		cephCluster.Spec.Monitoring.Exporter = &cephv1.CephExporterSpec{}
-		cephCluster.Spec.Monitoring.Exporter.HostNetwork = ptr.To(false)
-		cephCluster.Spec.Monitoring.Exporter.PerfCountersPrioLimit = prioLimitString
-		cephCluster.Spec.Monitoring.Exporter.StatsPeriodSeconds = statsPeriodString
-
-		cephCluster.Spec.Network.HostNetwork = false
-
 		exporterContainer := getCephExporterDaemonContainer(cephCluster, cephVersion)
 		assertCephExporterArgs(t, exporterContainer.Args, true)
 	})
diff --git a/pkg/operator/ceph/cluster/osd/spec_test.go b/pkg/operator/ceph/cluster/osd/spec_test.go
index 2979220c2..f9504af4c 100644
--- a/pkg/operator/ceph/cluster/osd/spec_test.go
+++ b/pkg/operator/ceph/cluster/osd/spec_test.go
@@ -168,7 +168,7 @@ func testPodDevices(t *testing.T, dataDir, deviceName string, allDevices bool) {
 	assert.Equal(t, c.clusterInfo.Namespace, deployment.Spec.Template.ObjectMeta.Labels["rook_cluster"])
 	assert.Equal(t, 1, len(deployment.Spec.Template.ObjectMeta.Annotations))
 
-	assert.Equal(t, 4, len(deployment.Spec.Template.Spec.InitContainers))
+	assert.Equal(t, 3, len(deployment.Spec.Template.Spec.InitContainers))
 	initCont := deployment.Spec.Template.Spec.InitContainers[0]
 	assert.Equal(t, "quay.io/ceph/ceph:v15", initCont.Image)
 	assert.Equal(t, "activate", initCont.Name)
@@ -179,10 +179,6 @@ func testPodDevices(t *testing.T, dataDir, deviceName string, allDevices bool) {
 	assert.Equal(t, 2, len(initCont.VolumeMounts))
 	initCont = deployment.Spec.Template.Spec.InitContainers[2]
 	assert.Equal(t, "quay.io/ceph/ceph:v15", initCont.Image)
-	assert.Equal(t, "cephx-keyring-update", initCont.Name)
-	assert.Equal(t, 3, len(initCont.VolumeMounts))
-	initCont = deployment.Spec.Template.Spec.InitContainers[3]
-	assert.Equal(t, "quay.io/ceph/ceph:v15", initCont.Image)
 	assert.Equal(t, "chown-container-data-dir", initCont.Name)
 	assert.Equal(t, 8, len(initCont.VolumeMounts))
 
@@ -210,12 +206,11 @@ func testPodDevices(t *testing.T, dataDir, deviceName string, allDevices bool) {
 	deployment, err = c.makeDeployment(osdProp, osd, dataPathMap)
 	assert.Nil(t, err)
 	assert.NotNil(t, deployment)
-	assert.Equal(t, 5, len(deployment.Spec.Template.Spec.InitContainers), deployment.Spec.Template.Spec.InitContainers[2].Name)
+	assert.Equal(t, 4, len(deployment.Spec.Template.Spec.InitContainers), deployment.Spec.Template.Spec.InitContainers[2].Name)
 	assert.Equal(t, "config-init", deployment.Spec.Template.Spec.InitContainers[0].Name)
 	assert.Equal(t, "copy-bins", deployment.Spec.Template.Spec.InitContainers[1].Name)
 	assert.Equal(t, "blkdevmapper", deployment.Spec.Template.Spec.InitContainers[2].Name)
-	assert.Equal(t, "cephx-keyring-update", deployment.Spec.Template.Spec.InitContainers[3].Name)
-	assert.Equal(t, "chown-container-data-dir", deployment.Spec.Template.Spec.InitContainers[4].Name)
+	assert.Equal(t, "chown-container-data-dir", deployment.Spec.Template.Spec.InitContainers[3].Name)
 	assert.Equal(t, 1, len(deployment.Spec.Template.Spec.Containers))
 	initCont = deployment.Spec.Template.Spec.InitContainers[0]
 	assert.Equal(t, 5, len(initCont.VolumeMounts), initCont.VolumeMounts)
@@ -232,12 +227,11 @@ func testPodDevices(t *testing.T, dataDir, deviceName string, allDevices bool) {
 	deployment, err = c.makeDeployment(osdProp, osd, dataPathMap)
 	assert.Nil(t, err)
 	assert.NotNil(t, deployment)
-	assert.Equal(t, 5, len(deployment.Spec.Template.Spec.InitContainers), deployment.Spec.Template.Spec.InitContainers[2].Name)
+	assert.Equal(t, 4, len(deployment.Spec.Template.Spec.InitContainers), deployment.Spec.Template.Spec.InitContainers[2].Name)
 	assert.Equal(t, "blkdevmapper", deployment.Spec.Template.Spec.InitContainers[0].Name)
 	assert.Equal(t, "activate", deployment.Spec.Template.Spec.InitContainers[1].Name)
 	assert.Equal(t, "expand-bluefs", deployment.Spec.Template.Spec.InitContainers[2].Name)
-	assert.Equal(t, "cephx-keyring-update", deployment.Spec.Template.Spec.InitContainers[3].Name)
-	assert.Equal(t, "chown-container-data-dir", deployment.Spec.Template.Spec.InitContainers[4].Name)
+	assert.Equal(t, "chown-container-data-dir", deployment.Spec.Template.Spec.InitContainers[3].Name)
 	assert.Equal(t, 1, len(deployment.Spec.Template.Spec.Containers))
 	cont = deployment.Spec.Template.Spec.Containers[0]
 	assert.Equal(t, 7, len(cont.VolumeMounts), cont.VolumeMounts)
@@ -247,7 +241,7 @@ func testPodDevices(t *testing.T, dataDir, deviceName string, allDevices bool) {
 	deployment, err = c.makeDeployment(osdProp, osd, dataPathMap)
 	assert.Nil(t, err)
 	assert.NotNil(t, deployment)
-	assert.Equal(t, 9, len(deployment.Spec.Template.Spec.InitContainers), deployment.Spec.Template.Spec.InitContainers[2].Name)
+	assert.Equal(t, 8, len(deployment.Spec.Template.Spec.InitContainers), deployment.Spec.Template.Spec.InitContainers[2].Name)
 	assert.Equal(t, "blkdevmapper", deployment.Spec.Template.Spec.InitContainers[0].Name)
 	assert.Equal(t, "encryption-open", deployment.Spec.Template.Spec.InitContainers[1].Name)
 	assert.Equal(t, "blkdevmapper-encryption", deployment.Spec.Template.Spec.InitContainers[2].Name)
@@ -257,13 +251,12 @@ func testPodDevices(t *testing.T, dataDir, deviceName string, allDevices bool) {
 	assert.Equal(t, "dev-mapper", deployment.Spec.Template.Spec.InitContainers[4].VolumeMounts[1].Name, deployment.Spec.Template.Spec.InitContainers[4].VolumeMounts)
 	assert.Equal(t, "activate", deployment.Spec.Template.Spec.InitContainers[5].Name)
 	assert.Equal(t, "expand-bluefs", deployment.Spec.Template.Spec.InitContainers[6].Name)
-	assert.Equal(t, "cephx-keyring-update", deployment.Spec.Template.Spec.InitContainers[7].Name)
-	assert.Equal(t, "chown-container-data-dir", deployment.Spec.Template.Spec.InitContainers[8].Name)
+	assert.Equal(t, "chown-container-data-dir", deployment.Spec.Template.Spec.InitContainers[7].Name)
 	assert.Equal(t, 1, len(deployment.Spec.Template.Spec.Containers))
 	cont = deployment.Spec.Template.Spec.Containers[0]
 	assert.Equal(t, 8, len(cont.VolumeMounts), cont.VolumeMounts)
 	osdProp.encrypted = false
-	assert.Equal(t, 11, len(deployment.Spec.Template.Spec.Volumes), deployment.Spec.Template.Spec.Volumes)
+	assert.Equal(t, 10, len(deployment.Spec.Template.Spec.Volumes), deployment.Spec.Template.Spec.Volumes)
 
 	// // Test OSD on PVC with RAW and metadata device
 	osd = &OSDInfo{
@@ -274,13 +267,12 @@ func testPodDevices(t *testing.T, dataDir, deviceName string, allDevices bool) {
 	deployment, err = c.makeDeployment(osdProp, osd, dataPathMap)
 	assert.Nil(t, err)
 	assert.NotNil(t, deployment)
-	assert.Equal(t, 6, len(deployment.Spec.Template.Spec.InitContainers))
+	assert.Equal(t, 5, len(deployment.Spec.Template.Spec.InitContainers))
 	assert.Equal(t, "blkdevmapper", deployment.Spec.Template.Spec.InitContainers[0].Name)
 	assert.Equal(t, "blkdevmapper-metadata", deployment.Spec.Template.Spec.InitContainers[1].Name)
 	assert.Equal(t, "activate", deployment.Spec.Template.Spec.InitContainers[2].Name)
 	assert.Equal(t, "expand-bluefs", deployment.Spec.Template.Spec.InitContainers[3].Name)
-	assert.Equal(t, "cephx-keyring-update", deployment.Spec.Template.Spec.InitContainers[4].Name)
-	assert.Equal(t, "chown-container-data-dir", deployment.Spec.Template.Spec.InitContainers[5].Name)
+	assert.Equal(t, "chown-container-data-dir", deployment.Spec.Template.Spec.InitContainers[4].Name)
 	assert.Equal(t, 1, len(deployment.Spec.Template.Spec.Containers))
 	cont = deployment.Spec.Template.Spec.Containers[0]
 	assert.Equal(t, 7, len(cont.VolumeMounts), cont.VolumeMounts)
@@ -288,7 +280,7 @@ func testPodDevices(t *testing.T, dataDir, deviceName string, allDevices bool) {
 	assert.Equal(t, 1, len(blkInitCont.VolumeDevices))
 	blkMetaInitCont := deployment.Spec.Template.Spec.InitContainers[2]
 	assert.Equal(t, 1, len(blkMetaInitCont.VolumeDevices))
-	assert.Equal(t, 11, len(deployment.Spec.Template.Spec.Volumes), deployment.Spec.Template.Spec.Volumes)
+	assert.Equal(t, 10, len(deployment.Spec.Template.Spec.Volumes), deployment.Spec.Template.Spec.Volumes)
 
 	// // Test encrypted OSD on PVC with RAW and metadata device
 	osd = &OSDInfo{
@@ -300,7 +292,7 @@ func testPodDevices(t *testing.T, dataDir, deviceName string, allDevices bool) {
 	deployment, err = c.makeDeployment(osdProp, osd, dataPathMap)
 	assert.Nil(t, err)
 	assert.NotNil(t, deployment)
-	assert.Equal(t, 12, len(deployment.Spec.Template.Spec.InitContainers))
+	assert.Equal(t, 11, len(deployment.Spec.Template.Spec.InitContainers))
 	assert.Equal(t, "blkdevmapper", deployment.Spec.Template.Spec.InitContainers[0].Name)
 	assert.Equal(t, "blkdevmapper-metadata", deployment.Spec.Template.Spec.InitContainers[1].Name)
 	assert.Equal(t, "encryption-open", deployment.Spec.Template.Spec.InitContainers[2].Name)
@@ -311,8 +303,7 @@ func testPodDevices(t *testing.T, dataDir, deviceName string, allDevices bool) {
 	assert.Equal(t, "expand-encrypted-bluefs", deployment.Spec.Template.Spec.InitContainers[7].Name)
 	assert.Equal(t, "activate", deployment.Spec.Template.Spec.InitContainers[8].Name)
 	assert.Equal(t, "expand-bluefs", deployment.Spec.Template.Spec.InitContainers[9].Name)
-	assert.Equal(t, "cephx-keyring-update", deployment.Spec.Template.Spec.InitContainers[10].Name)
-	assert.Equal(t, "chown-container-data-dir", deployment.Spec.Template.Spec.InitContainers[11].Name)
+	assert.Equal(t, "chown-container-data-dir", deployment.Spec.Template.Spec.InitContainers[10].Name)
 	assert.Equal(t, 1, len(deployment.Spec.Template.Spec.Containers))
 	cont = deployment.Spec.Template.Spec.Containers[0]
 	assert.Equal(t, 8, len(cont.VolumeMounts), cont.VolumeMounts)
@@ -321,7 +312,7 @@ func testPodDevices(t *testing.T, dataDir, deviceName string, allDevices bool) {
 	blkMetaInitCont = deployment.Spec.Template.Spec.InitContainers[8]
 	assert.Equal(t, 1, len(blkMetaInitCont.VolumeDevices))
 	osdProp.encrypted = false
-	assert.Equal(t, 13, len(deployment.Spec.Template.Spec.Volumes), deployment.Spec.Template.Spec.Volumes)
+	assert.Equal(t, 12, len(deployment.Spec.Template.Spec.Volumes), deployment.Spec.Template.Spec.Volumes)
 
 	// // Test OSD on PVC with RAW / metadata and wal device
 	osd = &OSDInfo{
@@ -333,14 +324,13 @@ func testPodDevices(t *testing.T, dataDir, deviceName string, allDevices bool) {
 	deployment, err = c.makeDeployment(osdProp, osd, dataPathMap)
 	assert.Nil(t, err)
 	assert.NotNil(t, deployment)
-	assert.Equal(t, 7, len(deployment.Spec.Template.Spec.InitContainers))
+	assert.Equal(t, 6, len(deployment.Spec.Template.Spec.InitContainers))
 	assert.Equal(t, "blkdevmapper", deployment.Spec.Template.Spec.InitContainers[0].Name)
 	assert.Equal(t, "blkdevmapper-metadata", deployment.Spec.Template.Spec.InitContainers[1].Name)
 	assert.Equal(t, "blkdevmapper-wal", deployment.Spec.Template.Spec.InitContainers[2].Name)
 	assert.Equal(t, "activate", deployment.Spec.Template.Spec.InitContainers[3].Name)
 	assert.Equal(t, "expand-bluefs", deployment.Spec.Template.Spec.InitContainers[4].Name)
-	assert.Equal(t, "cephx-keyring-update", deployment.Spec.Template.Spec.InitContainers[5].Name)
-	assert.Equal(t, "chown-container-data-dir", deployment.Spec.Template.Spec.InitContainers[6].Name)
+	assert.Equal(t, "chown-container-data-dir", deployment.Spec.Template.Spec.InitContainers[5].Name)
 	assert.Equal(t, 1, len(deployment.Spec.Template.Spec.Containers))
 	cont = deployment.Spec.Template.Spec.Containers[0]
 	assert.Equal(t, 7, len(cont.VolumeMounts), cont.VolumeMounts)
@@ -348,7 +338,7 @@ func testPodDevices(t *testing.T, dataDir, deviceName string, allDevices bool) {
 	assert.Equal(t, 1, len(blkInitCont.VolumeDevices))
 	blkMetaInitCont = deployment.Spec.Template.Spec.InitContainers[2]
 	assert.Equal(t, 1, len(blkMetaInitCont.VolumeDevices))
-	assert.Equal(t, 13, len(deployment.Spec.Template.Spec.Volumes), deployment.Spec.Template.Spec.Volumes)
+	assert.Equal(t, 12, len(deployment.Spec.Template.Spec.Volumes), deployment.Spec.Template.Spec.Volumes)
 
 	// // Test encrypted OSD on PVC with RAW / metadata and wal device
 	osd = &OSDInfo{
@@ -361,7 +351,7 @@ func testPodDevices(t *testing.T, dataDir, deviceName string, allDevices bool) {
 	deployment, err = c.makeDeployment(osdProp, osd, dataPathMap)
 	assert.Nil(t, err)
 	assert.NotNil(t, deployment)
-	assert.Equal(t, 15, len(deployment.Spec.Template.Spec.InitContainers))
+	assert.Equal(t, 14, len(deployment.Spec.Template.Spec.InitContainers))
 	assert.Equal(t, "blkdevmapper", deployment.Spec.Template.Spec.InitContainers[0].Name)
 	assert.Equal(t, "blkdevmapper-metadata", deployment.Spec.Template.Spec.InitContainers[1].Name)
 	assert.Equal(t, "blkdevmapper-wal", deployment.Spec.Template.Spec.InitContainers[2].Name)
@@ -375,8 +365,7 @@ func testPodDevices(t *testing.T, dataDir, deviceName string, allDevices bool) {
 	assert.Equal(t, "expand-encrypted-bluefs", deployment.Spec.Template.Spec.InitContainers[10].Name)
 	assert.Equal(t, "activate", deployment.Spec.Template.Spec.InitContainers[11].Name)
 	assert.Equal(t, "expand-bluefs", deployment.Spec.Template.Spec.InitContainers[12].Name)
-	assert.Equal(t, "cephx-keyring-update", deployment.Spec.Template.Spec.InitContainers[13].Name)
-	assert.Equal(t, "chown-container-data-dir", deployment.Spec.Template.Spec.InitContainers[14].Name)
+	assert.Equal(t, "chown-container-data-dir", deployment.Spec.Template.Spec.InitContainers[13].Name)
 	assert.Equal(t, 1, len(deployment.Spec.Template.Spec.Containers))
 	cont = deployment.Spec.Template.Spec.Containers[0]
 	assert.Equal(t, 8, len(cont.VolumeMounts), cont.VolumeMounts)
@@ -384,7 +373,7 @@ func testPodDevices(t *testing.T, dataDir, deviceName string, allDevices bool) {
 	assert.Equal(t, 1, len(blkInitCont.VolumeDevices))
 	blkMetaInitCont = deployment.Spec.Template.Spec.InitContainers[11]
 	assert.Equal(t, 1, len(blkMetaInitCont.VolumeDevices))
-	assert.Equal(t, 15, len(deployment.Spec.Template.Spec.Volumes), deployment.Spec.Template.Spec.Volumes)
+	assert.Equal(t, 14, len(deployment.Spec.Template.Spec.Volumes), deployment.Spec.Template.Spec.Volumes)
 
 	// Test with encrypted OSD on PVC with RAW with KMS
 	osdProp.encrypted = true
@@ -395,7 +384,7 @@ func testPodDevices(t *testing.T, dataDir, deviceName string, allDevices bool) {
 	deployment, err = c.makeDeployment(osdProp, osd, dataPathMap)
 	assert.Nil(t, err)
 	assert.NotNil(t, deployment)
-	assert.Equal(t, 10, len(deployment.Spec.Template.Spec.InitContainers), deployment.Spec.Template.Spec.InitContainers)
+	assert.Equal(t, 9, len(deployment.Spec.Template.Spec.InitContainers), deployment.Spec.Template.Spec.InitContainers)
 	assert.Equal(t, "blkdevmapper", deployment.Spec.Template.Spec.InitContainers[0].Name)
 	assert.Equal(t, "encryption-kms-get-kek", deployment.Spec.Template.Spec.InitContainers[1].Name)
 	assert.Equal(t, "encryption-open", deployment.Spec.Template.Spec.InitContainers[2].Name)
@@ -404,12 +393,11 @@ func testPodDevices(t *testing.T, dataDir, deviceName string, allDevices bool) {
 	assert.Equal(t, "expand-encrypted-bluefs", deployment.Spec.Template.Spec.InitContainers[5].Name)
 	assert.Equal(t, "activate", deployment.Spec.Template.Spec.InitContainers[6].Name)
 	assert.Equal(t, "expand-bluefs", deployment.Spec.Template.Spec.InitContainers[7].Name)
-	assert.Equal(t, "cephx-keyring-update", deployment.Spec.Template.Spec.InitContainers[8].Name)
-	assert.Equal(t, "chown-container-data-dir", deployment.Spec.Template.Spec.InitContainers[9].Name)
+	assert.Equal(t, "chown-container-data-dir", deployment.Spec.Template.Spec.InitContainers[8].Name)
 	assert.Equal(t, 1, len(deployment.Spec.Template.Spec.Containers))
 	cont = deployment.Spec.Template.Spec.Containers[0]
 	assert.Equal(t, 8, len(cont.VolumeMounts), cont.VolumeMounts)
-	assert.Equal(t, 11, len(deployment.Spec.Template.Spec.Volumes), deployment.Spec.Template.Spec.Volumes) // One more than the encryption with k8s for the kek get init container
+	assert.Equal(t, 10, len(deployment.Spec.Template.Spec.Volumes), deployment.Spec.Template.Spec.Volumes) // One more than the encryption with k8s for the kek get init container
 
 	// Test with encrypted OSD on PVC with RAW with KMS
 	osdProp.encrypted = true
@@ -420,7 +408,7 @@ func testPodDevices(t *testing.T, dataDir, deviceName string, allDevices bool) {
 	deployment, err = c.makeDeployment(osdProp, osd, dataPathMap)
 	assert.Nil(t, err)
 	assert.NotNil(t, deployment)
-	assert.Equal(t, 10, len(deployment.Spec.Template.Spec.InitContainers), deployment.Spec.Template.Spec.InitContainers)
+	assert.Equal(t, 9, len(deployment.Spec.Template.Spec.InitContainers), deployment.Spec.Template.Spec.InitContainers)
 	assert.Equal(t, "blkdevmapper", deployment.Spec.Template.Spec.InitContainers[0].Name)
 	assert.Equal(t, "encryption-kms-get-kek", deployment.Spec.Template.Spec.InitContainers[1].Name)
 	assert.Equal(t, "encryption-open", deployment.Spec.Template.Spec.InitContainers[2].Name)
@@ -429,12 +417,11 @@ func testPodDevices(t *testing.T, dataDir, deviceName string, allDevices bool) {
 	assert.Equal(t, "expand-encrypted-bluefs", deployment.Spec.Template.Spec.InitContainers[5].Name)
 	assert.Equal(t, "activate", deployment.Spec.Template.Spec.InitContainers[6].Name)
 	assert.Equal(t, "expand-bluefs", deployment.Spec.Template.Spec.InitContainers[7].Name)
-	assert.Equal(t, "cephx-keyring-update", deployment.Spec.Template.Spec.InitContainers[8].Name)
-	assert.Equal(t, "chown-container-data-dir", deployment.Spec.Template.Spec.InitContainers[9].Name)
+	assert.Equal(t, "chown-container-data-dir", deployment.Spec.Template.Spec.InitContainers[8].Name)
 	assert.Equal(t, 1, len(deployment.Spec.Template.Spec.Containers))
 	cont = deployment.Spec.Template.Spec.Containers[0]
 	assert.Equal(t, 8, len(cont.VolumeMounts), cont.VolumeMounts)
-	assert.Equal(t, 12, len(deployment.Spec.Template.Spec.Volumes), deployment.Spec.Template.Spec.Volumes)
+	assert.Equal(t, 11, len(deployment.Spec.Template.Spec.Volumes), deployment.Spec.Template.Spec.Volumes)
 
 	// Test with encrypted OSD on PVC with RAW with KMS with TLS
 	osdProp.encrypted = true
@@ -445,7 +432,7 @@ func testPodDevices(t *testing.T, dataDir, deviceName string, allDevices bool) {
 	deployment, err = c.makeDeployment(osdProp, osd, dataPathMap)
 	assert.Nil(t, err)
 	assert.NotNil(t, deployment)
-	assert.Equal(t, 12, len(deployment.Spec.Template.Spec.Volumes), deployment.Spec.Template.Spec.Volumes)                                     // One more than the encryption with k8s for the kek get init container
+	assert.Equal(t, 11, len(deployment.Spec.Template.Spec.Volumes), deployment.Spec.Template.Spec.Volumes)                                     // One more than the encryption with k8s for the kek get init container
 	assert.Equal(t, 3, len(deployment.Spec.Template.Spec.Volumes[8].VolumeSource.Projected.Sources), deployment.Spec.Template.Spec.Volumes[0]) // 3 more since we have the tls secrets
 	osdProp.encrypted = false
 
diff --git a/pkg/operator/ceph/csi/secrets_test.go b/pkg/operator/ceph/csi/secrets_test.go
index 61f3e6cf0..7b3d2116a 100644
--- a/pkg/operator/ceph/csi/secrets_test.go
+++ b/pkg/operator/ceph/csi/secrets_test.go
@@ -17,17 +17,9 @@ limitations under the License.
 package csi
 
 import (
-	"context"
 	"testing"
 
-	"github.com/rook/rook/pkg/clusterd"
-	"github.com/rook/rook/pkg/daemon/ceph/client"
-	"github.com/rook/rook/pkg/operator/ceph/config/keyring"
-	"github.com/rook/rook/pkg/operator/k8sutil"
 	"github.com/stretchr/testify/assert"
-	apierrors "k8s.io/apimachinery/pkg/api/errors"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	k8sfake "k8s.io/client-go/kubernetes/fake"
 )
 
 func TestCephCSIKeyringRBDNodeCaps(t *testing.T) {
@@ -49,78 +41,3 @@ func TestCephCSIKeyringCephFSProvisionerCaps(t *testing.T) {
 	caps := cephCSIKeyringCephFSProvisionerCaps()
 	assert.Equal(t, caps, []string{"mon", "allow r, allow command 'osd blocklist'", "mgr", "allow rw", "osd", "allow rw tag cephfs metadata=*", "mds", "allow *"})
 }
-
-func Test_deleteOwnedCSISecretsByCephCluster(t *testing.T) {
-	const (
-		namespace   = "rook-ceph"
-		cephCluster = "my-ceph-cluster"
-	)
-
-	// Create fake client
-	clientset := k8sfake.NewSimpleClientset()
-
-	// Cluster context
-	clusterContext := &clusterd.Context{
-		Clientset: clientset,
-	}
-
-	clusterInfo := &client.ClusterInfo{
-		OwnerInfo: k8sutil.NewOwnerInfoWithOwnerRef(&metav1.OwnerReference{
-			APIVersion: "ceph.rook.io/v1",
-			Kind:       "CephCluster",
-			Name:       cephCluster,
-		}, namespace),
-	}
-	clusterInfo.Namespace = namespace
-	clusterInfo.SetName(cephCluster)
-
-	ctx := &clusterd.Context{
-		Clientset: clientset,
-	}
-
-	k := keyring.GetSecretStore(ctx, clusterInfo, clusterInfo.OwnerInfo)
-
-	// create csi secrets
-	err := createOrUpdateCSISecret(clusterInfo, "", "", "", "", k)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	// Remove ownerRef from the CsiCephFSNodeSecret to ensure it won't get deleted
-	secret, err := clientset.CoreV1().Secrets(namespace).Get(context.TODO(), CsiCephFSProvisionerSecret, metav1.GetOptions{})
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	secret.OwnerReferences = nil
-	secret.SetOwnerReferences([]metav1.OwnerReference{
-		{
-			APIVersion: "ceph.rook.io/v1",
-			Kind:       "CephClient",
-			Name:       "test-client",
-		},
-	})
-	_, err = clientset.CoreV1().Secrets(namespace).Update(context.TODO(), secret, metav1.UpdateOptions{})
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	err = deleteOwnedCSISecretsByCephCluster(clusterContext, clusterInfo)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	// Verify owned secret is deleted
-	secrets := []string{CsiRBDNodeSecret, CsiRBDProvisionerSecret, CsiCephFSNodeSecret}
-	for _, secretName := range secrets {
-		_, err = clientset.CoreV1().Secrets(namespace).Get(context.TODO(), secretName, metav1.GetOptions{})
-		if err == nil {
-			t.Errorf("expected owned secret %q to be deleted", secretName)
-		}
-	}
-	// Verify unowned secret still exists
-	_, err = clientset.CoreV1().Secrets(namespace).Get(context.TODO(), CsiCephFSProvisionerSecret, metav1.GetOptions{})
-	if err != nil && apierrors.IsNotFound(err) {
-		t.Errorf("expected unowned secret %q to still exist", CsiCephFSProvisionerSecret)
-	}
-}
diff --git a/pkg/operator/ceph/csi/util_test.go b/pkg/operator/ceph/csi/util_test.go
index 2a84543fb..4fb20fe02 100644
--- a/pkg/operator/ceph/csi/util_test.go
+++ b/pkg/operator/ceph/csi/util_test.go
@@ -280,7 +280,7 @@ func Test_getImage(t *testing.T) {
 		{
 			name: "test with default image",
 			args: args{
-				defaultImage: "quay.io/cephcsi/cephcsi:v3.14.1",
+				defaultImage: "quay.io/cephcsi/cephcsi:v3.14.0",
 			},
 			want: DefaultCSIPluginImage,
 		},
diff --git a/pkg/operator/k8sutil/secret_test.go b/pkg/operator/k8sutil/secret_test.go
deleted file mode 100644
index d62bec1ef..000000000
--- a/pkg/operator/k8sutil/secret_test.go
+++ /dev/null
@@ -1,273 +0,0 @@
-/*
-Copyright 2025 The Rook Authors. All rights reserved.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-	http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package k8sutil
-
-import (
-	"context"
-	"fmt"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	corev1 "k8s.io/api/core/v1"
-	k8serrors "k8s.io/apimachinery/pkg/api/errors"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	k8sfake "k8s.io/client-go/kubernetes/fake"
-	k8stesting "k8s.io/client-go/testing"
-	"k8s.io/utils/ptr"
-)
-
-func TestIsSameOwnerReference(t *testing.T) {
-	// Matching owner references
-	refA := metav1.OwnerReference{
-		APIVersion: "ceph.rook.io/v1",
-		Kind:       "CephClient",
-		Name:       "my-client",
-	}
-	refB := metav1.OwnerReference{
-		APIVersion: "ceph.rook.io/v1",
-		Kind:       "CephClient",
-		Name:       "my-client",
-	}
-
-	// Mismatched owner references
-	refC := metav1.OwnerReference{
-		APIVersion: "ceph.rook.io/v1",
-		Kind:       "CephClient",
-		Name:       "different-client",
-	}
-
-	// Test matching references
-	assert.True(t, IsSameOwnerReference(refA, refB), "expected owner references to match")
-
-	// Test mismatched references
-	assert.False(t, IsSameOwnerReference(refA, refC), "expected owner references to not match")
-}
-
-func TestDeleteSecretIfOwnedBy(t *testing.T) {
-	owner := metav1.OwnerReference{
-		APIVersion: "v1",
-		Kind:       "CephCluster",
-		Name:       "ceph-cluster",
-		Controller: ptr.To(true),
-	}
-
-	tests := []struct {
-		name            string
-		secret          *corev1.Secret
-		getSecretErr    error
-		deleteSecretErr error
-		expectedDelete  bool
-		expectedErr     bool
-	}{
-		{
-			name:           "secret not found",
-			getSecretErr:   k8serrors.NewNotFound(schema.GroupResource{Group: "", Resource: "secrets"}, "my-secret"),
-			expectedDelete: false,
-			expectedErr:    false,
-		},
-		{
-			name:           "error getting secret",
-			getSecretErr:   fmt.Errorf("API error"),
-			expectedDelete: false,
-			expectedErr:    true,
-		},
-		{
-			name: "secret has no owner",
-			secret: &corev1.Secret{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      "my-secret",
-					Namespace: "default",
-				},
-			},
-			expectedDelete: false,
-			expectedErr:    false,
-		},
-		{
-			name: "secret has different owner",
-			secret: &corev1.Secret{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      "my-secret",
-					Namespace: "default",
-					OwnerReferences: []metav1.OwnerReference{{
-						APIVersion: "v1",
-						Kind:       "CephCluster",
-						Name:       "other-ceph-cluster",
-						Controller: ptr.To(true),
-					}},
-				},
-			},
-			expectedDelete: false,
-			expectedErr:    false,
-		},
-		{
-			name: "secret owned by caller, deletion succeeds",
-			secret: &corev1.Secret{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      "my-secret",
-					Namespace: "default",
-					OwnerReferences: []metav1.OwnerReference{{
-						APIVersion: "v1",
-						Kind:       "CephCluster",
-						Name:       "my-ceph-cluster",
-						Controller: ptr.To(true),
-					}},
-				},
-			},
-			expectedDelete: true,
-			expectedErr:    false,
-		},
-		{
-			name: "secret owned by caller, deletion returns error",
-			secret: &corev1.Secret{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:            "my-secret",
-					Namespace:       "default",
-					OwnerReferences: []metav1.OwnerReference{owner},
-				},
-			},
-			deleteSecretErr: fmt.Errorf("delete error"),
-			expectedDelete:  true,
-			expectedErr:     true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			client := k8sfake.NewSimpleClientset()
-
-			if tt.getSecretErr != nil || tt.secret != nil {
-				client.Fake.PrependReactor("get", "secrets", func(action k8stesting.Action) (handled bool, ret runtime.Object, err error) {
-					if tt.getSecretErr != nil {
-						return true, nil, tt.getSecretErr
-					}
-					return true, tt.secret, nil
-				})
-			}
-
-			if tt.expectedDelete {
-				client.Fake.PrependReactor("delete", "secrets", func(action k8stesting.Action) (handled bool, ret runtime.Object, err error) {
-					return true, nil, tt.deleteSecretErr
-				})
-			}
-
-			err := DeleteSecretIfOwnedBy(context.TODO(), client, "my-secret", "default", owner)
-			if tt.expectedErr {
-				assert.Error(t, err)
-			} else {
-				assert.NoError(t, err)
-			}
-		})
-	}
-}
-
-func TestUpdateSecretIfOwnedBy(t *testing.T) {
-	ctx := context.TODO()
-	client := k8sfake.NewSimpleClientset()
-
-	expectedOwner := metav1.OwnerReference{
-		APIVersion: "v1",
-		Kind:       "CephCluster",
-		Name:       "rook-ceph",
-		Controller: ptr.To(true),
-	}
-
-	namespace := "default"
-	// 1. Secret owned by expected controller → should be updated
-	secret1 := &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      "test-secret",
-			Namespace: namespace,
-			OwnerReferences: []metav1.OwnerReference{
-				expectedOwner,
-			},
-		},
-		Data: map[string][]byte{
-			"foo": []byte("bar"),
-		},
-	}
-
-	// Create the secret
-	_, err := client.CoreV1().Secrets(namespace).Create(ctx, secret1, metav1.CreateOptions{})
-	assert.NoError(t, err)
-
-	// Modify it locally before update
-	secret1.Data["foo"] = []byte("updated")
-
-	err = UpdateSecretIfOwnedBy(ctx, client, secret1)
-	assert.NoError(t, err)
-
-	updated, _ := client.CoreV1().Secrets(namespace).Get(ctx, secret1.Name, metav1.GetOptions{})
-	assert.Equal(t, []byte("updated"), updated.Data["foo"])
-
-	// 2. Secret without any owner
-	secret2 := &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      "without-owner",
-			Namespace: namespace,
-		},
-		Data: map[string][]byte{
-			"key": []byte("val"),
-		},
-	}
-	_, err = client.CoreV1().Secrets(namespace).Create(ctx, secret2, metav1.CreateOptions{})
-	assert.NoError(t, err)
-
-	secret2.Data["key"] = []byte("should-not-update")
-
-	err = UpdateSecretIfOwnedBy(ctx, client, secret2)
-	assert.Error(t, err)
-
-	// 3. Secret owned by someone else → should not be updated
-	otherOwner := metav1.OwnerReference{
-		APIVersion: "v1",
-		Kind:       "OtherController",
-		Name:       "other",
-		Controller: ptr.To(true),
-	}
-	secret3 := &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      "owned-by-others",
-			Namespace: namespace,
-			OwnerReferences: []metav1.OwnerReference{
-				otherOwner,
-			},
-		},
-		Data: map[string][]byte{
-			"key": []byte("before"),
-		},
-	}
-	_, err = client.CoreV1().Secrets(namespace).Create(ctx, secret3, metav1.CreateOptions{})
-	assert.NoError(t, err)
-
-	secret3.Data["key"] = []byte("should-not-update")
-
-	secret3.OwnerReferences = []metav1.OwnerReference{expectedOwner}
-	err = UpdateSecretIfOwnedBy(ctx, client, secret3)
-	assert.Error(t, err)
-
-	// 4. Secret does not exist → should return error
-	secret4 := &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      "nonexistent",
-			Namespace: namespace,
-		},
-	}
-	err = UpdateSecretIfOwnedBy(ctx, client, secret4)
-	assert.Error(t, err)
-}