diff --git a/ceph/setup/keyring.sls b/ceph/setup/keyring.sls
index bd49b45..f26c608 100644
--- a/ceph/setup/keyring.sls
+++ b/ceph/setup/keyring.sls
@@ -11,12 +11,6 @@
 
 {% for keyring_name, keyring in common.get('keyring', {}).iteritems() %}
 
-{% set keyring_cmd = "ceph -c /etc/ceph/"+ common.get('cluster_name', 'ceph') + ".conf auth get-or-create client." %}
-{% set keyring_cap = [] %}
-{%- for cap_name, cap in  keyring.caps.iteritems() %}
-  {% do keyring_cap.append(cap_name + " '" + cap + "' ")%}
-{%- endfor %}
-
 {%- if keyring.name is defined %}
 
 {%- if keyring.name != 'admin' and keyring.key is defined and common.get("manage_keyring", False) %}
@@ -37,11 +31,10 @@
 
 {%- elif keyring.name != 'admin' %}
 
-{% set key_contents = salt['cmd.shell'](keyring_cmd + keyring.name + " " + keyring_cap|join(" ")) %}
 ceph_create_keyring_{{ keyring.name }}:
-  file.managed:
-  - name: {{ common.prefix_dir }}/etc/ceph/{{ common.get('cluster_name', 'ceph') }}.client.{{ keyring.name }}.keyring
-  - contents: {{ key_contents | yaml_encode }}
+  cmd.run:
+  - name: "ceph -c /etc/ceph/{{ common.get('cluster_name', 'ceph') }}.conf auth get-or-create client.{{ keyring.name }} {%- for cap_name, cap in  keyring.caps.iteritems() %} {{ cap_name }} '{{ cap }}' {%- endfor %} > {{ common.prefix_dir }}/etc/ceph/{{ common.get('cluster_name', 'ceph') }}.client.{{ keyring.name }}.keyring"
+  - unless: "test -f {{ common.prefix_dir }}/etc/ceph/{{ common.get('cluster_name', 'ceph') }}.client.{{ keyring.name }}.keyring"
 
 {%- endif %}
 
@@ -65,11 +58,10 @@
 
 {%- elif keyring_name != 'admin' %}
 
-{% set key_contents = salt['cmd.shell'](keyring_cmd + keyring_name + " " + keyring_cap|join(" ")) %}
 ceph_create_keyring_{{ keyring_name }}:
-  file.managed:
-  - name: {{ common.prefix_dir }}/etc/ceph/{{ common.get('cluster_name', 'ceph') }}.client.{{ keyring_name }}.keyring
-  - contents: {{ key_contents | yaml_encode }}
+  cmd.run:
+  - name: "ceph -c /etc/ceph/{{ common.get('cluster_name', 'ceph') }}.conf auth get-or-create client.{{ keyring_name }} {%- for cap_name, cap in  keyring.caps.iteritems() %} {{ cap_name }} '{{ cap }}' {%- endfor %} > {{ common.prefix_dir }}/etc/ceph/{{ common.get('cluster_name', 'ceph') }}.client.{{ keyring_name }}.keyring"
+  - unless: "test -f {{ common.prefix_dir }}/etc/ceph/{{ common.get('cluster_name', 'ceph') }}.client.{{ keyring_name }}.keyring"
 
 {%- endif %}