Skip to content

Workspace: Ceph Admin

When to use

Use Ceph Admin for Ceph RGW cluster-level operations.

Dashboard

The dashboard remains focused on endpoint health, current or recent incidents when present, and the four links to metrics, RGW accounts, RGW users and buckets. Status timestamps wrap on small screens; they refer to stored checks, not a new probe.

See the dashboard preview.

Prerequisites

  • Admin-like UI role.
  • can_access_ceph_admin entitlement.
  • ceph_admin_enabled feature and at least one compatible endpoint.

Steps

  1. Open /ceph-admin.
  2. Select the active endpoint in the top selector.
  3. If you enabled Show selector tags from User profile, compact color-coded Standard endpoint tags are shown directly in the selector. Administrative tags remain limited to management surfaces.
  4. Use pages:
  5. Accounts: RGW account operations.
  6. Users: RGW user operations.
  7. Buckets: cluster-level bucket inventory and configuration. Bucket quota and usage columns can be enabled as single-line atomic columns for easier reading and cleaner CSV exports.
  8. Usage & Metrics: tabbed cluster-level usage composition, endpoint storage metrics, and traffic metrics.
  9. Browser: object navigation when enabled.
  10. In Buckets, long-running bulk actions show progress bars with completion and failure counters. Select one or more rows, then open Actions…. The menu separates local selection tools, S3 API operations, RGW Admin Ops, and destructive S3 operations. Bulk configuration actions include lifecycle rules and bucket notification configurations, with preview before apply. Selected buckets can also run usage-stat calculations, and each bucket configuration drawer exposes the latest snapshot from the Usage stats tab.
  11. Bucket listings are cached for up to 30 minutes to reduce RGW load. Use Refresh in the bucket workbench to flush the cache and reload the current listing.

RGW Admin Ops actions

Bucket names open S3 API configuration. The row action menu separates navigation, S3 API, RGW Admin Ops, and destructive RGW operations. Each Admin Ops operation shows the endpoint, target, impact, available options, required confirmation, and the result returned by RGW. The result stays open and includes the RGW HTTP status, the Ceph error code when present, and the JSON or text response body.

Bucket configuration opens in a wide drawer while the bucket workbench stays mounted. The URL remains deep-linkable as /ceph-admin/buckets?ep=<endpoint>&configure=<bucket>. The currently viewed bucket is marked in the list independently from checkbox selection, and the drawer provides Previous / Next navigation across the loaded rows. Close the drawer to return to the unchanged list with its filters, sort, page, selection, and scroll position preserved.

Accounts

Account creation accepts an optional Ceph tenant. This is a direct Ceph Admin operation and remains available even when Managed RGW tenant creation is disabled in General settings.

Use Delete account to remove an empty RGW Account. RGW Accounts require Ceph Squid or later. RGW rejects deletion while the Account still owns Users, Buckets, Roles, Groups, or other resources.

Confirmation:

DELETE ACCOUNT <account_id>

Users

When creating an RGW user, the UID must be free in the selected tenant/account scope. An existing UID produces a conflict; BucketReef will not silently reuse the existing RGW principal or its access keys. If creation returns a conflict, verify the UID and account association in RGW before retrying. User configuration, access-key operations and deletion also verify the selected account association; refresh the users list if the identity or account changed. Editing a user's ordinary profile does not change its account-root status.

Without an Account, the create form accepts an optional tenant. When an Account is selected, BucketReef inherits that Account's tenant and locks the tenant field; a contradictory tenant is rejected by the backend.

Use Delete user to remove an empty RGW User. Purge owned data is off by default and passes purge-data to RGW when explicitly enabled. The RGW User whose credentials provide the active Ceph Admin connection cannot delete itself.

Confirmations:

DELETE USER <tenant$uid>
PURGE USER <tenant$uid>

Buckets

The bucket row menu provides these operations:

  • Delete bucket removes an empty bucket. Purge objects and versions passes purge-objects and permanently deletes the bucket and its contents.
  • Unlink bucket removes the current owner association while leaving the bucket data in place.
  • Link bucket associates the bucket with a selected existing RGW User or RGW Account. Link is not a chown and does not rewrite object ACLs.
  • Check bucket index runs a read-only index check by default. Enabling Check object state requires Fix detected index issues.

bypass-gc is hidden under Advanced options, disabled until purge-objects is enabled, and off by default. Use it only for exceptional operator recovery: it bypasses normal RGW garbage collection handling.

Confirmations:

DELETE BUCKET <tenant/bucket>
PURGE AND DELETE BUCKET <tenant/bucket>
UNLINK BUCKET <tenant/bucket>
LINK BUCKET <tenant/bucket> TO <target_id>
FIX BUCKET INDEX <tenant/bucket>

A read-only index check uses the confirmation button without a typed phrase. For multi-selection diagnostics, use Actions… > RGW Admin Ops > Check bucket indexes…. The bulk workflow is read-only, supports at most 200 buckets, shows per-bucket results, and never enables index repair. Repairs remain unitary.

Operational tutorials

Use these runbooks when the task spans a group of buckets and needs a repeatable selection, review, change, and verification workflow.

Goal Tutorial
Standardize a lifecycle rule without overwriting unrelated rules Standardize Bucket Lifecycle Policies at Scale
Remove stale multipart-upload parts automatically Clean Up Abandoned Multipart Uploads at Scale
Limit growth from retained object versions Control Storage Growth on Versioned Buckets
Build a capacity review queue before a quota is exhausted Find Buckets Approaching Their Quota
Review and remediate potential public exposure Audit Public S3 Exposure Across a Ceph RGW Cluster
Diagnose index inconsistencies after an RGW incident Check Bucket Indexes in Bulk After RGW Inconsistencies
Apply the same S3 event notification to a bucket family Roll Out S3 Event Notifications Across Multiple Buckets
Inventory encryption algorithms and KMS keys Audit Server-Side Encryption and KMS Usage

The tutorials intentionally keep Advanced filter and UI tags as shared building blocks. They are reference tools used by several operational campaigns rather than separate copies of the same selection procedure.

Expected result

You can run Ceph cluster-wide tasks without switching to account-scoped Manager workflows.

Limits / feature flags

Note

Workspace visibility requires both user entitlement and ceph_admin_enabled. Browser integration also depends on browser_ceph_admin_enabled.

Visual example

Ceph Admin workspace with endpoint and RGW inventory Ceph Admin workspace with endpoint and RGW inventory