Ceph RGW IAM accounts for multi-tenant S3
Giving each team or customer its own IAM space: account root users, IAM users, groups, roles and policies, account quotas, and moving from deprecated tenant-level IAM.
Ceph object storage (RGW)
Specific tasks for running the Ceph Object Gateway as S3-compatible storage: tenancy, encryption, lifecycle, events, large buckets, load balancing, failover and API compatibility.
Ceph RGW server-side encryption with Vault, KMIP or Barbican
Choosing between SSE-C, SSE-KMS and SSE-S3: key management backends, HTTPS requirements behind proxies, AES-GCM versus CBC, blocking SSE-C and multisite consistency.
Ceph RGW lifecycle rules and transition to cloud storage
Expiring and tiering objects: lifecycle rules across storage classes, transition to a remote S3 tier, restore behavior, one-way transitions and what metadata is lost.
Ceph RGW bucket notifications to Kafka, AMQP and HTTP
Triggering pipelines when objects change: topics and notifications, event filters, persistent delivery with retries, and the 503 errors when an endpoint is down too long.
Large Ceph RGW buckets: index sharding and dynamic resharding
Keeping buckets with hundreds of millions of objects fast: objects per shard, automatic and manual resharding, prime shard counts, minimum shards and resharding in multisite.
Load balancing Ceph RGW with the cephadm ingress service
Fronting RGW daemons with haproxy and keepalived: virtual IPs, host and daemon counts, TLS termination choices and when to use an external load balancer instead.
Failing over a Ceph RGW multisite zone
A failover and failback runbook: promoting a secondary zone, committing the period, what fails while the master zone is down, and restoring the original master.
Ceph RGW S3 API compatibility: what works and what does not
Checking application fit before migrating: supported, partial and missing S3 features, replication limits, IAM and STS coverage, and testing the SDKs your applications use.
Using the OpenStack Swift API on Ceph RGW
Serving Swift clients from RGW: supported operations, ACL subset, temporary URL and versioning gaps, missing CORS and running Swift and S3 against the same data.
TLS certificates for Ceph RGW with cephadm
Certificate options for RGW endpoints: cephadm-signed, inline and referenced certificates, wildcard SANs for virtual-host buckets, and the deprecated frontend certificate field.
Ceph RGW quotas for accounts, users and buckets
Setting storage limits per account and bucket, account-wide usage statistics, and quota behavior customers see when limits are reached.
