Contents Menu Expand Light mode Dark mode Auto light/dark mode
Documentation Portal
  • 25.2
  • 25.1 and earlier
Logo
Mirantis OpenStack for Kubernetes
  • Product Overview
  • Reference Architecture
    • Major components and principles
    • Cluster types
    • Requirements
      • MOSK cluster hardware requirements
      • Management cluster storage
      • System requirements for the seed node
      • Components collocation
      • Infrastructure requirements
      • Network requirements
    • Management cluster
      • Bare-metal provider
      • Release Controller
      • Management console
      • Identity and access management
        • External identity provider integration
        • Authentication and authorization
          • Implementation flow
          • Kubernetes CLI authentication flow
        • Expose Keycloak on an additional MetalLB address pool
    • Cloud services
      • Compute service
        • Resource oversubscription
        • Virtual CPU
        • Instance migration
        • Image storage backend
        • Remote console access to virtual machines
        • GPU virtualization
        • Graceful instance shutdown
      • Networking service
        • Backends
        • General configuration
        • BGP dynamic routing
        • Virtual Private Network
        • DVR incompatibility with ARP announcements and VRRP
        • Single Root I/O Virtualization
      • Block Storage service
        • Backup configuration
        • Volume encryption
        • Volume configuration
      • Identity service
        • Federation
        • Regions
        • Application credentials
        • Domain-specific configuration
      • Image service
      • Object Storage service
      • Dashboard
      • Bare Metal service
      • DNS service
      • Key Manager service
      • Instance High Availability service
        • Instance HA overview
        • Enabling the Instance HA service
        • Enabling introspective instance monitor
      • Shared Filesystems service
      • Dynamic Resource Balancer service
    • OpenStack
      • OpenStack cluster
      • OpenStack lifecycle management
        • OpenStack Controller (Rockoon)
        • OpenStackDeployment Admission Controller
        • OpenStack Exporter
      • OpenStack configuration
        • OpenStackDeployment custom resource
        • OpenStackDeployment spec:services
        • OpenStackDeploymentStatus custom resource
        • OpenStack Controller configuration
        • Custom OpenStack images
      • OpenStack database
        • Overview of the OpenStack database backup and restoration
        • Workflows of the OpenStack database backup and restoration
        • OpenStack database auto-cleanup
        • Periodic OpenStack database backups
        • Remote storage for OpenStack database backups
        • Synchronization of local MariaDB backups with a remote S3 storage
      • OpenStack message bus
    • OpenSDN
      • OpenSDN cluster
        • OpenSDN cluster components
        • OpenSDN traffic flow
      • OpenSDN lifecycle management
        • OpenSDN Operator
        • TFOperator custom resource
      • OpenSDN configuration
        • Cassandra configuration
        • Custom vRouter settings
        • Control plane traffic interface
        • Traffic encapsulation
        • Autonomous System Number (ASN)
        • Access to external DNS
        • Gateway for vRouter data plane network
        • OpenSDN image precaching
        • Graceful restart and long-lived graceful restart
        • Configuring the protocol for connecting to Cassandra clusters
        • SR-IOV Spoof Check control for OpenSDN
        • Availability zones
      • OpenSDN database
        • Periodic OpenSDN database backups
        • Remote storage for OpenSDN database backups
      • OpenSDN services
        • OpenSDN load balancing (HAProxy)
        • Octavia Amphora load balancing
      • OpenSDN known limitations
      • OpenSDN integration with OpenStack
      • OpenSDN IPv6 support
    • Networking
      • Networking overview
      • Management cluster networking
      • MOSK cluster networking
      • IP Address Management
      • Multi-rack architecture
      • Physical networks layout
      • Underlay networking: routing configuration
      • Performance optimization
      • Built-in load balancing
      • Proxy support and cache of artifacts
      • Infrastructure connectivity monitoring
    • Bare metal
      • Bare-metal components
      • Extended hardware configuration
    • Kubernetes underlay
      • LCM custom resources
      • LCM Controller
      • LCM Agent
      • Helm Controller
      • MKE API limitations
      • MKE configuration management
      • MKE backup
    • Storage
      • Pelagia overview
      • Pelagia limitations
      • Pelagia integration with Rockoon
      • Addressing Ceph storage devices
    • Logging, monitoring, and alerting
      • Deployment architecture
      • Supported features
      • Authentication flow
      • Monitored components
      • Storage-based log retention strategy
      • OpenSearch and Prometheus storage sizing
      • StackLight integration with OpenStack
      • Workload monitoring
      • Outbound telemetry
      • StackLight logging indices
      • StackLight proxy
    • Blueprints
      • Remote compute nodes
        • Introduction to edge computing
        • Overview of the remote compute nodes approach
        • Design considerations for a remote site
        • Remote compute nodes with Tungsten Fabric
      • Large clusters
      • Cephless cloud
      • Air-gapped clusters
        • Directory and URL structure
        • Limitations on Logging, Monitoring, and Alerting
        • Requirements for air-gapped clusters
        • Configure and deploy an air-gapped cluster
          • Prepare an offline copy for an air-gapped cluster
          • Create a local mirror
          • Deploy an air-gapped management cluster
          • Monitor the airgapped tool status in JSON format
        • Update a cluster in an air-gapped environment
      • Integration with Enterprise Identity Directory (LDAP/AD)
        • Architecture overview
        • Configuration
        • Workflows
    • Node maintenance API
      • Node maintenance API objects
      • OpenStack Controller maintenance API
      • OpenSDN Kubernetes Controller maintenance API
      • Cluster update flow
      • Parallelizing node update operations
  • Deployment Guide
    • Plan the deployment
    • Provision and deploy a management cluster
      • Deploy a management cluster
        • Introduction
        • Overview of the deployment workflow
        • Controlled bare-metal provisioning workflows
        • Set up a bootstrap cluster
        • Deploy a management cluster
        • Configure bare-metal settings
          • Configure BIOS on a bare-metal host
          • Customize the default bare-metal host profile
          • Configure NIC bonding
          • Separate PXE and management (LCM) networks
          • Configure multiple DHCP address ranges
          • Enable dynamic IP allocation
          • Set a custom external IP address for the DHCP service
        • Configure optional settings
        • Post-deployment steps
      • Create initial users after a management cluster bootstrap
      • Requirements for a MITM proxy
      • Configure external identity provider for IAM
        • Configure LDAP for IAM
        • Configure Google OAuth IdP for IAM
    • Create a MOSK cluster
      • Create a project for MOSK clusters
      • Add a bare-metal host
        • Add a bare-metal host using MOSK management console
        • Add a bare-metal host using CLI
      • Create a custom bare-metal host profile
        • Default configuration of the host system storage
        • Wipe a device or partition
        • Create MOSK host profiles
        • Configure Ceph disks in a host profile
        • Enable huge pages in a host profile
        • Configure RAID support
          • Create an LVM software RAID (raid1)
          • Create LVM volume groups on top of RAID devices
          • Create an mdadm software RAID (raid0, raid1, raid10)
          • Create an mdadm software RAID level 10 (raid10)
      • Create a MOSK cluster
        • Create a MOSK cluster
        • Configure MetalLB
          • Configure and verify MetalLB
          • Configure node selectors for MetalLB speakers
        • Configure BGP announcement for cluster API LB address
        • Obtain and use details about network interfaces
        • Create subnets
          • Service labels and their life cycle
          • Create subnets for a cluster using MOSK management console
          • Create subnets for a cluster using CLI
        • Create L2 templates
          • Create an L2 template for a new cluster
          • Create L2 templates for a multi-rack MOSK cluster
          • Create an L2 template for a Kubernetes manager node
          • Create an L2 template for a MOSK controller node
          • Create an L2 template for a MOSK compute node
          • Create an L2 template for a MOSK storage node
          • L2 template example with bonds and bridges
        • Example of a complete template configuration for cluster creation
      • Add a machine
        • Create a machine using CLI
        • Create a machine using MOSK management console
        • Assign L2 templates to machines
        • Deploy a machine to a specific bare-metal host
        • Override network interfaces naming and order
        • Manually allocate IP addresses for bare-metal hosts
      • Add a Ceph cluster using CephDeployment
    • Deploy OpenStack
      • Deploy an OpenStack cluster
      • Advanced OpenStack configuration (optional)
        • Enable LVM ephemeral storage
        • Enable LVM block storage
        • Enable SR-IOV with OVS/OVN
        • Encrypt the east-west traffic
        • Enable Cinder backend for Glance
        • Enable Cinder volume encryption
        • Advanced configuration for OpenStack compute nodes
          • Configuration recommendations for compute node types
          • Configure the CPU model
          • Enable huge pages for OpenStack
          • Configure CPU isolation for a compute node
          • Configure custom CPU topologies
          • Configure PCI passthrough for guests
          • Configure initial resource oversubscription
          • Limit HW resources for hyperconverged OpenStack compute nodes
          • Configure GPU virtualization
        • Enable image signature verification
        • Configure LoadBalancer for PowerDNS
      • Access OpenStack after deployment
        • Configure DNS to access OpenStack
        • Access your OpenStack environment
      • Troubleshoot an OpenStack deployment
        • Debugging the Helm releases
        • Debugging the OpenStack Controller
        • Debugging the OsDpl CR
        • Support dump
    • Deploy OpenSDN
      • OpenSDN deployment prerequisites
      • Deploy OpenSDN
      • Advanced OpenSDN configuration
        • Enable huge pages for OpenStack with Tungsten Fabric
        • Enable SR-IOV for OpenSDN
        • Configure multiple Contrail API workers
      • Troubleshoot the OpenSDN deployment
        • Enable debug logs for the Tungsten Fabric services
        • Troubleshoot access to the OpenSDN web UI
        • Disable TX offloading on NICs used by vRouter
  • Operations Guide
    • Cluster update
      • Update to a major version
      • Update to a patch version
      • Verify the management cluster status before MOSK update
      • Change the upgrade order of a machine
      • Configure the parallel update of worker nodes
      • Create update groups for worker machines
      • Granularly update MOSK using the ClusterUpdatePlan object
      • Configure update auto-pause
    • Configure backups of Mirantis Kubernetes Engine
      • Create backups of Mirantis Kubernetes Engine
      • Restore Mirantis Kubernetes Engine from a backup
    • Getting access
      • Generate a kubeconfig for a MOSK cluster using API
      • Connect to a MOSK cluster
      • Access the Keycloak Admin Console
      • Access the OpenSDN web UI
    • OpenStack operations
      • Migrate networking from Open vSwitch to Open Virtual Network
        • Migration limitations and impact
        • Prepare environment for migration
        • Perform pre-migration verification
        • Adjust security groups to allow access to DHCP and Metadata
        • Adjust MTU for VXLAN tenant networks
        • Adjust DNS servers for subnets
        • Perform migration
        • Verification and cleanup
      • Upgrade OpenStack
      • Backup and restore OpenStack databases
        • Enable OpenStack database remote backups
        • Restore OpenStack databases from a backup
        • Verify the periodic backup jobs for the OpenStack database
      • Add a controller node
      • Replace a failed controller node
      • Add a compute node
      • Change oversubscription settings for existing compute nodes
      • Delete a compute node
      • Run Tempest tests
      • Remove an OpenStack cluster
      • Remove an OpenStack service
      • Enable uploading of an image through Horizon with untrusted SSL certificates
      • Rotate OpenStack credentials
      • Customize OpenStack container images
      • Troubleshoot orphaned resource allocations
      • Start monitoring IP address capacity
      • Rotate Octavia Amphora (LBaaS) certificates
      • Enroll a bare-metal node with Redfish Virtual Media
    • OpenStack services configuration
      • Configure high availability with Masakari
      • Verify the Instance HA service
      • Configure monitoring of cloud workload availability
    • Ceph operations
      • Comparison of KaaSCephCluster, MiraCeph, and CephDeployment specifications
      • CephDeployment operations
        • Ceph resources management
          • Enable management of Ceph tolerations and resources
          • Verify Ceph tolerations and resources
        • Ceph user credentials
          • Manage Ceph RBD or CephFS clients
          • Manage Ceph Object Storage users
        • Configure Ceph Shared File System (CephFS)
        • Ceph default configuration
        • Share Ceph across two clusters
        • Migrate Ceph pools from one failure domain to another
        • Move a Ceph Monitor daemon to another node
        • Move Ceph Monitor before node replacement
        • Enable Ceph multinetwork
        • Ceph Object Storage
          • Enable Ceph RADOS Gateway Object Storage
          • Enable Multisite for Ceph Object Storage
          • Configure Ceph Object Storage server-side encryption
          • Configure Ceph Object Gateway TLS
          • RADOS Gateway bucket policy
            • Create Ceph Object Storage users
            • Set a bucket policy for a Ceph Object Storage user
            • Set a bucket policy for OpenStack users
        • Enable Ceph RBD mirroring
        • Specify Rook daemons placement
      • Ceph cluster lifecycle management
        • Automated lifecycle management
          • Create a Ceph OSD remove task
          • Add, remove, or reconfigure Ceph nodes
          • Add, remove, or reconfigure Ceph OSDs
          • Add, remove, or reconfigure Ceph OSDs with metadata devices
          • Replace a failed Ceph node
          • Replace a failed Ceph OSD
          • Replace a failed metadata device
          • Replace a failed Ceph OSD disk with a metadata device as a device name
          • Replace a failed Ceph OSD with a metadata device as a logical volume path
        • Increase Ceph cluster storage size
        • Remove Ceph OSD manually
      • Rockoon integration
        • Integrate Pelagia with Rockoon
        • Configure Ceph pools for Cinder multiple backends
        • Calculate target ratios for Ceph pools for Rockoon
      • Verify Ceph
        • Verify the Ceph core services
        • Verify Ceph cluster state
        • Verify Pelagia Controllers and Rook Ceph Operator
        • Verify rook-discover
    • StackLight operations
      • Configure StackLight
        • StackLight configuration procedure
        • StackLight configuration parameters
        • Verify StackLight after configuration
      • Tune OpenSearch performance
      • Export logs from OpenSearch Dashboards to CSV
      • OpenSearch Dashboards
        • View OpenSearch Dashboards
        • Search in OpenSearch Dashboards
      • View Grafana dashboards
      • Create custom dashboards in Grafana
      • Export data from Table panels of Grafana dashboards to CSV
      • StackLight alerts
        • OpenStack
          • OpenStack system services
            • Libvirt
            • MariaDB
            • Memcached
            • SSL certificates
            • RabbitMQ
          • OpenStack core services
            • OpenStack services API
            • Cinder
            • Horizon
            • Ironic
            • Neutron
            • Nova
            • Cloudprober
            • Portprober
            • PowerDNS
            • Credential rotation
          • OpenStack Controller (Rockoon)
        • OpenSDN
          • Cassandra
          • Redis
          • Tungsten Fabric Operator
          • OpenSDN
          • ZooKeeper
        • StackLight
          • Alertmanager
          • cAdvisor
          • Elasticsearch Exporter
          • Fluentd
          • General
          • Grafana
          • Monitoring of external endpoints
          • OpenSearch
          • PostgreSQL and Patroni
          • Prometheus
          • Prometheus MS Teams
          • Prometheus Relay
          • ServiceNow
          • Salesforce notifier
          • Telegraf
          • Telemeter
        • Ceph
        • Bare metal
          • Bond interface
          • Ironic
          • Kernel
          • Host Operating System Modules Controller
          • IPMI
        • Generic
          • Calico
          • Etcd
        • Kubernetes
          • Kubernetes applications
          • Kubernetes resources
          • Kubernetes storage
          • Kubernetes system
        • Keycloak
        • MOSK management
          • Helm Controller
          • MOSK management
          • MOSK management cache
          • MOSK management controllers
          • MOSK management providers
          • MOSK and MOSK management SSL
          • Release Controller
        • Mirantis Kubernetes Engine
        • Node
          • General
          • Node network
          • Node time
          • mdadm RAID
          • NUMA
        • Cross-node connectivity
      • Alert dependencies
      • Silence alerts
      • StackLight rules for Kubernetes network policies
      • Tune StackLight for long-term log retention
      • Enable log forwarding to external destinations
      • Enable remote logging to syslog
      • Create log-based metrics
      • Enable generic metric scraping
      • Manage metrics filtering
      • Use S.M.A.R.T. metrics for creating alert rules
      • Deschedule StackLight Pods from a worker machine
      • Tune Prometheus IPMI exporter
    • OpenSDN operations
      • Update OpenSDN
      • Back up OpenSDN data
      • Restore OpenSDN data
      • Track OpenSDN node maintenance progress
      • Replace a failed OpenSDN controller node
      • Delete a vRouter node
      • Verify the OpenSDN deployment
      • Configure load balancing
      • Enable OpenSDN Cassandra repairs
      • Enable contrail-tools
      • Enable tf-api-cli
    • Bare-metal operations
      • Upgrade an operating system distribution
      • Automatic upgrade of a host operating system
      • Remove old Ubuntu kernel packages
      • Host operating system configuration
        • Host OS configuration management workflow
        • Global recommendations for implementation of custom modules
        • Format and structure of a module package
        • Modules provided by MOSK
        • HostOSConfiguration and HostOSConfigurationModules concepts
        • Internal API for host OS configuration management
        • Add a custom module to a MOSK deployment
        • Test a custom or MOSK module after creation
        • Retrigger a module configuration
        • Troubleshooting
      • Migrate auditd settings from the Cluster object to the auditd module
      • Change a user name and password for a bare-metal host
      • Restart the inspection of a bare-metal host
      • Restart a bare-metal host
      • Replace a failed manager node
      • Modify network configuration on an existing machine
      • Add more racks to an existing MOSK cluster
      • Expand IP addresses capacity in an existing cluster
      • Enable network infrastructure monitoring
      • Run cluster self-diagnostics
        • Trigger self-diagnostics for a cluster
        • Self-upgrades of the Diagnostic Controller
        • Diagnostic checks for the bare-metal provider
    • IAM operations
      • Manage user roles through the MOSK management API
        • Available IAM roles and use cases
        • Mapping of Keycloak roles to IAM*RoleBinding objects
      • Manage user roles through the MOSK management console
      • Manage user roles through Keycloak
        • MOSK roles and scopes
        • Use cases
      • Change the password for Keycloak master user
      • Change passwords for IAM users
      • Obtain MariaDB credentials for IAM
      • Manage Keycloak truststore using the MOSK management console
    • Management cluster operations
      • MOSK management CLI
      • Workflow and configuration of management cluster upgrade
      • Schedule MOSK management updates
      • Renew the MOSK and MKE licenses
      • Configure NTP server
      • Automatically propagate Salesforce configuration to all clusters
      • Update the Keycloak IP address on bare-metal clusters
      • Configure host names for cluster machines
      • Back up MariaDB on a management cluster
        • Configure periodic backups of MariaDB
        • Verify operability of the MariaDB backup jobs
        • Restore MariaDB databases
        • Change the storage node for MariaDB
      • Remove a management cluster
      • Warm up the MOSK management cache
    • General operations
      • Change a cluster configuration
      • Enable cluster and machine maintenance mode
        • Enable maintenance mode on a cluster and machine using management console
        • Enable maintenance mode on a cluster and machine using CLI
      • Disable a machine
      • Perform a graceful reboot of a cluster
      • Delete a cluster machine
        • Precautions for a cluster machine deletion
        • Delete a cluster machine using the management console
        • Delete a cluster machine using CLI
      • Delete a MOSK cluster
      • Verify cluster status
      • Verify machine status
    • Underlay Kubernetes operations
      • Set the MTU size for Calico
      • Add or update a CA certificate for a MITM proxy using API
      • Configure TLS certificates for cluster applications
      • Define a custom CA certificate for a private Docker registry
      • Increase memory limits for cluster components
      • Increase storage quota for etcd
      • Configure Kubernetes auditing and profiling
    • Limitations
  • Troubleshooting Guide
    • Collect cluster logs
    • Inspect the history of a cluster and machine deployment or update
    • Cluster deletion freezes
    • Keycloak admin console becomes inaccessible after changing the theme
    • Unresponsive OpenSDN API due to excessive Cassandra tombstone records
    • The ‘database space exceeded’ error on large clusters
    • The auditd events cause ‘backlog limit exceeded’ messages
    • Troubleshoot a management cluster bootstrap
      • Troubleshoot the bootstrap node configuration
        • DNS settings
        • Default network addresses
      • Troubleshoot the bootstrap region creation
      • Troubleshoot machine creation
      • Troubleshoot deployment stages
      • Collect the bootstrap logs
    • Troubleshoot bare metal
      • Log in to the IPA virtual console for hardware troubleshooting
      • Inspection error on bare-metal hosts after dnsmasq restart
      • Troubleshoot an operating system upgrade with host restart
      • Troubleshoot iPXE boot issues
      • Provisioning failure due to device naming issues in a bare-metal host profile
    • Troubleshoot Ceph
      • Ceph disaster recovery
      • The ceph-exporter pods are present in the Ceph crash list
      • Ceph Monitors recovery
      • Ceph Monitors store.db size rapidly growing
      • Replaced Ceph OSD fails to start on authorization
      • Ceph health reports PG_DAMAGED after a failed disk or node replacement
      • CephOsdRemoveTask failure with a timeout during rebalance
      • Maintenance stuck on a compact Ceph cluster
    • Troubleshoot StackLight
      • Patroni replication lag
      • Alertmanager does not send resolve notifications for custom alerts
      • Troubleshoot alerts
        • Troubleshoot cAdvisor alerts
        • Troubleshoot Helm Controller alerts
        • Troubleshoot Host Operating System Modules Controller alerts
        • Troubleshoot Ubuntu kernel alerts
        • Troubleshoot Kubernetes applications alerts
        • Troubleshoot Kubernetes resources alerts
        • Troubleshoot Kubernetes storage alerts
        • Troubleshoot Kubernetes system alerts
        • Troubleshoot MOSK management Exporter alerts
        • Troubleshoot Mirantis Kubernetes Engine alerts
        • Troubleshoot OpenSearch alerts
        • Troubleshoot Release Controller alerts
        • Troubleshoot Ceph alerts
        • Troubleshoot Telemeter client alerts
      • OpenSearchPVCMismatch alert raises due to the OpenSearch PVC size mismatch
      • OpenSearch cluster deadlock due to the corrupted index
      • Failure of shard relocation in the OpenSearch cluster
      • StackLight pods get stuck with the ‘NodeAffinity failed’ error
      • No logs are forwarded to Splunk
      • Troubleshoot high OpenSearch indexing pressure
  • API Reference
    • Management resources
      • General resources
        • PublicKey resource
        • License resource
        • TLSConfig resource
        • ContainerRegistry resource
        • MCCUpgrade resource
        • CacheWarmupRequest resource
      • IAM resources
        • IAMUser resource
        • IAMRole resource
        • IAMGlobalRoleBinding resource
        • IAMRoleBinding resource
        • IAMClusterRoleBinding resource
      • Cluster resources
        • BareMetalHost resource
        • BareMetalHostCredential resource
        • BareMetalHostInventory resource
        • BareMetalHostProfile resource
        • Cluster resource
        • Machine resource
      • Cluster lifecycle resources
        • Diagnostic resource
        • GracefulRebootRequest resource
        • ClusterUpdatePlan resource
        • UpdateGroup resource
        • UpdateAutoPause resource
        • Cluster backup resources
          • ClusterBackup resource
          • ClusterBackupSchedule resource
          • KeyEncryptionKey resource
          • RCloneCredential resource
      • Networking resources
        • IPaddr
        • IpamHost
        • L2Template
        • MetalLBConfig
        • MultiRackCluster
        • Rack
        • Subnet
      • Network infrastructure monitoring resources
        • InfraConnectivityMonitor
        • CheckerInventoryConfig
        • NetCheckerTargetsConfig
      • Host OS configuration resources
        • HostOSConfiguration
        • HostOSConfigurationModules
    • OpenStack Operator resources
    • OpenSDN Operator (TFOperator) resources
    • Ceph resources
      • CephDeployment custom resource
      • CephDeploymentHealth custom resource
      • CephDeploymentSecret custom resource
      • CephOsdRemoveTask custom resource
    • StackLight resources
  • User Guide
    • Use the Instance HA service
    • Configure the introspective instance monitor
    • Manage application credentials
    • Authenticate in OpenStack API as a federated OIDC user
    • Use the Shared Filesystems service
      • Set up Shared Filesystems service with generic driver
      • Set up Shared Filesystems service with CephFS driver
    • Deploy your first cloud application using automation
    • Deploy your first cloud application using cloud web UI
    • Use Heat to create and manage OpenSDN objects
    • Use S3 API for MOSK Object Storage
    • Run Windows guests
    • Use the Dynamic Resource Balancer service
    • Migrate instances
    • Configure network trunking in projects
    • Configure per-instance migration mode
    • Access the bare-metal node console
    • Configure VPN for cloud applications
  • Security Guide
    • CADF audit notifications in OpenStack services
    • Rotation of credentials in OpenStack
    • Firewall configuration
      • MOSK management
      • Mirantis Kubernetes Engine
      • StackLight
      • Ceph
      • MOSK
      • OpenStack
      • Tungsten Fabric
    • Cluster auditing
      • Host operating system
    • OpenStack API access policies
    • Data protection
      • Data encryption capabilities
      • Encryption of live migration data
      • Encryption of cloud control plane communications
    • Compliance
      • Federal Information Processing Standards (FIPS)
      • Center for Internet Security (CIS) benchmarks for host OS
    • Container images signing and validation
    • LBaaS certificate
    • Software Bill of Materials
      • Concepts and objectives
      • Compatible tools and ecosystem
      • Format of SBOM
  • FAQ

Release and Lifecycle Information

  • Release Notes
    • 26.1
      • New features
      • Known issues
      • Release artifacts
        • MOSK cluster artifacts
        • Management cluster artifacts
      • Addressed issues
      • Update notes
      • Security notes
  • Compatibility Matrix
    • MOSK cluster components compatibility
    • Management cluster components compatibility
    • Cluster versions compatibility
    • MOSK cluster update schema
  • Deprecation Notes
    • OpenStack
    • OpenSDN (Tungsten Fabric)
    • Bare metal
    • MOSK management
    • Ceph
    • StackLight
  • Release cadence and support cycle

RADOS Gateway bucket policy

This section provides Ceph procedures for Amazon S3 buckets and bucket policies.

  • Create Ceph Object Storage users
  • Set a bucket policy for a Ceph Object Storage user
  • Set a bucket policy for OpenStack users
Next
Create Ceph Object Storage users
Previous
Configure Ceph Object Gateway TLS

Mirantis Inc. 900 E Hamilton Avenue, Suite 650, Campbell, CA 95008 +1-650-963-9828

© 2005 - 2026 Mirantis, Inc. All rights reserved. "Mirantis" and "FUEL" are registered trademarks of Mirantis, Inc. All other trademarks are the property of their respective owners.