diff --git a/ceph/templates/bin/_ceph-key.sh.tpl b/ceph/templates/bin/_ceph-key.sh.tpl
index df1da64615..6a8d63b5e7 100644
--- a/ceph/templates/bin/_ceph-key.sh.tpl
+++ b/ceph/templates/bin/_ceph-key.sh.tpl
@@ -18,6 +18,8 @@ limitations under the License.
 
 set -ex
 
+{{ if .Release.IsInstall }}
+
 function ceph_gen_key () {
   python ${CEPH_GEN_DIR}/ceph-key.py
 }
@@ -51,3 +53,9 @@ EOF
 
 #create_kube_key <ceph_key> <ceph_keyring_name> <ceph_keyring_template> <kube_secret_name>
 create_kube_key $(ceph_gen_key) ${CEPH_KEYRING_NAME} ${CEPH_KEYRING_TEMPLATE} ${KUBE_SECRET_NAME}
+
+{{ else }}
+
+echo "Not touching ${KUBE_SECRET_NAME} as this is not the initial deployment"
+
+{{- end -}}
diff --git a/ceph/templates/bin/_ceph-storage-key.sh.tpl b/ceph/templates/bin/_ceph-storage-key.sh.tpl
index 54588864f5..c8ee2dc5e2 100644
--- a/ceph/templates/bin/_ceph-storage-key.sh.tpl
+++ b/ceph/templates/bin/_ceph-storage-key.sh.tpl
@@ -17,6 +17,7 @@ limitations under the License.
 */}}
 
 set -ex
+{{ if .Release.IsInstall }}
 
 function ceph_gen_key () {
   python ${CEPH_GEN_DIR}/ceph-key.py
@@ -75,3 +76,9 @@ EOF
 }
 #create_kube_storage_key <ceph_key> <kube_secret_name>
 create_kube_storage_key ${CEPH_CLIENT_KEY} ${CEPH_STORAGECLASS_ADMIN_SECRET_NAME}
+
+{{ else }}
+
+echo "Not touching ${KUBE_SECRET_NAME} as this is not the initial deployment"
+
+{{ end }}