diff --git a/ceph/setup/keyring.sls b/ceph/setup/keyring.sls
index f26c608..bd49b45 100644
--- a/ceph/setup/keyring.sls
+++ b/ceph/setup/keyring.sls
@@ -11,6 +11,12 @@
 
 {% for keyring_name, keyring in common.get('keyring', {}).iteritems() %}
 
+{% set keyring_cmd = "ceph -c /etc/ceph/"+ common.get('cluster_name', 'ceph') + ".conf auth get-or-create client." %}
+{% set keyring_cap = [] %}
+{%- for cap_name, cap in  keyring.caps.iteritems() %}
+  {% do keyring_cap.append(cap_name + " '" + cap + "' ")%}
+{%- endfor %}
+
 {%- if keyring.name is defined %}
 
 {%- if keyring.name != 'admin' and keyring.key is defined and common.get("manage_keyring", False) %}
@@ -31,10 +37,11 @@
 
 {%- elif keyring.name != 'admin' %}
 
+{% set key_contents = salt['cmd.shell'](keyring_cmd + keyring.name + " " + keyring_cap|join(" ")) %}
 ceph_create_keyring_{{ keyring.name }}:
-  cmd.run:
-  - name: "ceph -c /etc/ceph/{{ common.get('cluster_name', 'ceph') }}.conf auth get-or-create client.{{ keyring.name }} {%- for cap_name, cap in  keyring.caps.iteritems() %} {{ cap_name }} '{{ cap }}' {%- endfor %} > {{ common.prefix_dir }}/etc/ceph/{{ common.get('cluster_name', 'ceph') }}.client.{{ keyring.name }}.keyring"
-  - unless: "test -f {{ common.prefix_dir }}/etc/ceph/{{ common.get('cluster_name', 'ceph') }}.client.{{ keyring.name }}.keyring"
+  file.managed:
+  - name: {{ common.prefix_dir }}/etc/ceph/{{ common.get('cluster_name', 'ceph') }}.client.{{ keyring.name }}.keyring
+  - contents: {{ key_contents | yaml_encode }}
 
 {%- endif %}
 
@@ -58,10 +65,11 @@
 
 {%- elif keyring_name != 'admin' %}
 
+{% set key_contents = salt['cmd.shell'](keyring_cmd + keyring_name + " " + keyring_cap|join(" ")) %}
 ceph_create_keyring_{{ keyring_name }}:
-  cmd.run:
-  - name: "ceph -c /etc/ceph/{{ common.get('cluster_name', 'ceph') }}.conf auth get-or-create client.{{ keyring_name }} {%- for cap_name, cap in  keyring.caps.iteritems() %} {{ cap_name }} '{{ cap }}' {%- endfor %} > {{ common.prefix_dir }}/etc/ceph/{{ common.get('cluster_name', 'ceph') }}.client.{{ keyring_name }}.keyring"
-  - unless: "test -f {{ common.prefix_dir }}/etc/ceph/{{ common.get('cluster_name', 'ceph') }}.client.{{ keyring_name }}.keyring"
+  file.managed:
+  - name: {{ common.prefix_dir }}/etc/ceph/{{ common.get('cluster_name', 'ceph') }}.client.{{ keyring_name }}.keyring
+  - contents: {{ key_contents | yaml_encode }}
 
 {%- endif %}