diff --git a/devstack/plugin.sh b/devstack/plugin.sh
index 91066e76d..3f0525e60 100644
--- a/devstack/plugin.sh
+++ b/devstack/plugin.sh
@@ -244,7 +244,7 @@ function configure_gnocchi {
     if is_service_enabled ceph && [[ "$GNOCCHI_STORAGE_BACKEND" = 'ceph' ]] ; then
         iniset $GNOCCHI_CONF storage driver ceph
         iniset $GNOCCHI_CONF storage ceph_username ${GNOCCHI_CEPH_USER}
-        iniset $GNOCCHI_CONF storage ceph_keyring ${CEPH_CONF_DIR}/ceph.client.${GNOCCHI_CEPH_USER}.keyring
+        iniset $GNOCCHI_CONF storage ceph_secret $(awk '/key/{print $3}' ${CEPH_CONF_DIR}/ceph.client.${GNOCCHI_CEPH_USER}.keyring)
     elif is_service_enabled swift && [[ "$GNOCCHI_STORAGE_BACKEND" = 'swift' ]] ; then
         iniset $GNOCCHI_CONF storage driver swift
         iniset $GNOCCHI_CONF storage swift_user gnocchi_swift
diff --git a/gnocchi/storage/ceph.py b/gnocchi/storage/ceph.py
index fe749d7da..de3302a9c 100644
--- a/gnocchi/storage/ceph.py
+++ b/gnocchi/storage/ceph.py
@@ -47,8 +47,8 @@ OPTS = [
                help='Ceph pool name to use.'),
     cfg.StrOpt('ceph_username',
                help='Ceph username (ie: admin without "client." prefix).'),
-    cfg.StrOpt('ceph_keyring',
-               help='Ceph keyring path.'),
+    cfg.StrOpt('ceph_secret', help='Ceph key', secret=True),
+    cfg.StrOpt('ceph_keyring', help='Ceph keyring path.'),
     cfg.StrOpt('ceph_conffile',
                default='/etc/ceph/ceph.conf',
                help='Ceph configuration file.'),
@@ -63,6 +63,8 @@ class CephStorage(_carbonara.CarbonaraBasedStorage):
         options = {}
         if conf.ceph_keyring:
             options['keyring'] = conf.ceph_keyring
+        if conf.ceph_secret:
+            options['key'] = conf.ceph_secret
 
         if not rados:
             raise ImportError("No module named 'rados' nor 'cradox'")