Contents Menu Expand Light mode Dark mode Auto light/dark mode
Documentation Portal
  • 26.1
  • 25.2
  • 25.1 and earlier
Logo
Mirantis OpenStack for Kubernetes
  • Product Overview
  • Reference Architecture
    • Major components and principles
    • Cluster types
    • Requirements
      • MOSK cluster hardware requirements
      • Management cluster storage
      • Host operating system disk layout
      • System requirements for the seed node
      • Components collocation
      • Infrastructure requirements
      • Network requirements
    • Management cluster
      • Bare-metal provider
      • Release Controller
      • Management console
      • Identity and access management
        • External identity provider integration
        • Authentication and authorization
          • Implementation flow
          • Kubernetes CLI authentication flow
        • Expose Keycloak on an additional MetalLB address pool
    • Cloud services
      • Compute service
        • Resource oversubscription
        • Virtual CPU
        • Instance migration
        • Image storage backend
        • Remote console access to virtual machines
        • GPU virtualization
        • NVLink topology-aware scheduling of multi-GPU instances
        • Graceful instance shutdown
      • Networking service
        • Backends
        • General configuration
        • BGP dynamic routing
        • Virtual Private Network
        • DVR incompatibility with ARP announcements and VRRP
        • Single Root I/O Virtualization
      • Block Storage service
        • Backup configuration
        • Volume encryption
        • Volume configuration
      • Identity service
        • Federation
        • Regions
        • Application credentials
        • Domain-specific configuration
      • Image service
      • Object Storage service
      • Dashboard
      • Bare Metal service
      • DNS service
      • Key Manager service
      • Instance High Availability service
        • Instance HA overview
        • Enabling the Instance HA service
        • Enabling introspective instance monitor
      • Shared Filesystems service
      • Dynamic Resource Balancer service
      • Tenant Telemetry service
    • OpenStack
      • OpenStack cluster
      • OpenStack lifecycle management
        • OpenStack Controller (Rockoon)
        • OpenStackDeployment Admission Controller
        • OpenStack Exporter
      • OpenStack configuration
        • OpenStackDeployment custom resource
        • OpenStackDeployment spec:services
        • OpenStackDeploymentStatus custom resource
        • OpenStack Controller configuration
        • Custom OpenStack images
      • OpenStack database
        • Overview of the OpenStack database backup and restoration
        • Workflows of the OpenStack database backup and restoration
        • OpenStack database auto-cleanup
        • Periodic OpenStack database backups
        • Remote storage for OpenStack database backups
        • Synchronization of local MariaDB backups with a remote S3 storage
      • OpenStack message bus
    • OpenSDN
      • OpenSDN cluster
        • OpenSDN cluster components
        • OpenSDN traffic flow
      • OpenSDN lifecycle management
        • OpenSDN Operator
        • TFOperator custom resource
      • OpenSDN configuration
        • Cassandra configuration
        • Custom vRouter settings
        • Control plane traffic interface
        • Traffic encapsulation
        • Autonomous System Number (ASN)
        • External BGP MPLS L3 VPN (VPNv4) route advertisement
        • Access to external DNS
        • Gateway for vRouter data plane network
        • OpenSDN image precaching
        • Graceful restart and long-lived graceful restart
        • Configuring the protocol for connecting to Cassandra clusters
        • SR-IOV Spoof Check control for OpenSDN
        • Availability zones
      • OpenSDN database
        • Periodic OpenSDN database backups
        • Remote storage for OpenSDN database backups
      • OpenSDN services
        • OpenSDN load balancing (HAProxy)
        • Octavia Amphora load balancing
      • OpenSDN known limitations
      • OpenSDN integration with OpenStack
      • OpenSDN IPv6 support
    • Networking
      • Networking overview
      • Management cluster networking
      • MOSK cluster networking
      • IP Address Management
      • Multi-rack architecture
      • Physical networks layout
      • Underlay networking: routing configuration
      • Performance optimization
      • Built-in load balancing
      • Proxy support and cache of artifacts
      • Infrastructure connectivity monitoring
    • Bare metal
      • Bare-metal components
      • Extended hardware configuration
    • Kubernetes underlay
      • LCM custom resources
      • LCM Controller
      • LCM Agent
      • Helm Controller
      • Kubernetes distributions
      • Migration from MKE to k0s
      • k0s configuration management
      • MKE configuration management
      • MKE API limitations
      • Kubernetes underlay backup
    • Storage
      • Pelagia overview
      • Pelagia limitations
      • Pelagia integration with Rockoon
      • Addressing Ceph storage devices
    • Logging, monitoring, and alerting
      • Deployment architecture
      • Supported features
      • Authentication flow
      • Monitored components
      • Storage-based log retention strategy
      • OpenSearch and Prometheus storage sizing
      • StackLight integration with OpenStack
      • Workload monitoring
      • Outbound telemetry
      • StackLight logging indices
      • StackLight proxy
    • Blueprints
      • Remote compute nodes
        • Introduction to edge computing
        • Overview of the remote compute nodes approach
        • Design considerations for a remote site
        • Remote compute nodes with Tungsten Fabric
      • Large clusters
      • Cephless cloud
      • Air-gapped clusters
        • Directory and URL structure
        • Limitations on Logging, Monitoring, and Alerting
        • Requirements for air-gapped clusters
        • Configure and deploy an air-gapped cluster
          • Prepare an offline copy for an air-gapped cluster
          • Create a local mirror
          • Deploy an air-gapped management cluster
          • Monitor the airgapped tool status in JSON format
        • Update a cluster in an air-gapped environment
      • Integration with Enterprise Identity Directory (LDAP/AD)
        • Architecture overview
        • Configuration
        • Workflows
      • NVIDIA ASAP² Direct datapath offloading
        • Blueprint scope and intended audience
        • Architecture
        • Topologies and use cases
        • Requirements
        • Configuration and activation
        • Limitations
        • Performance
      • Short-lived token-based SSH access to MOSK cluster nodes
        • Architecture overview
        • Configure token-based SSH access to MOSK using Vault and Keycloak
    • Node maintenance API
      • Node maintenance API objects
      • OpenStack Controller maintenance API
      • OpenSDN Kubernetes Controller maintenance API
      • Cluster update flow
      • Parallelizing node update operations
  • Deployment Guide
    • Plan the deployment
    • Provision and deploy a management cluster
      • Deploy a management cluster
        • Introduction
        • Overview of the deployment workflow
        • Controlled bare-metal provisioning workflows
        • Set up a bootstrap cluster
        • Deploy a management cluster
        • Configure bare-metal settings
          • Configure BIOS on a bare-metal host
          • Customize the default bare-metal host profile
          • Configure NIC bonding
          • Separate PXE and management (LCM) networks
          • Configure multiple DHCP address ranges
          • Enable dynamic IP allocation
          • Set a custom external IP address for the DHCP service
        • Configure optional settings
        • Post-deployment steps
      • Create initial users after a management cluster bootstrap
      • Requirements for a MITM proxy
      • Configure external identity provider for IAM
        • Configure LDAP for IAM
        • Configure Google OAuth IdP for IAM
    • Create a MOSK cluster
      • Create a project for MOSK clusters
      • Add a bare-metal host
        • Add a bare-metal host using MOSK management console
        • Add a bare-metal host using CLI
      • Create a custom bare-metal host profile
        • Default configuration of the host system storage
        • Wipe a device or partition
        • Create MOSK host profiles
        • Configure Ceph disks in a host profile
        • Configure a separate metadata device for Ceph OSD
        • Enable huge pages in a host profile
        • Configure RAID support
          • Create an LVM software RAID (raid1)
          • Create LVM volume groups on top of RAID devices
          • Create an mdadm software RAID (raid0, raid1, raid10)
          • Create an mdadm software RAID level 10 (raid10)
      • Create a MOSK cluster
        • Create a MOSK cluster
        • Configure MetalLB
          • Configure and verify MetalLB
          • Configure a dedicated Keycloak address pool for a management cluster
          • Configure node selectors for MetalLB speakers
        • Configure BGP announcement for cluster API LB address
        • Obtain and use details about network interfaces
        • Create subnets
          • Service labels and their life cycle
          • Create subnets for a cluster using MOSK management console
          • Create subnets for a cluster using CLI
        • Create L2 templates
          • Create an L2 template for a new cluster
          • Create L2 templates for a multi-rack MOSK cluster
          • Create an L2 template for a Kubernetes manager node
          • Create an L2 template for a MOSK controller node
          • Create an L2 template for a MOSK compute node
          • Create an L2 template for a MOSK storage node
          • L2 template example with bonds and bridges
        • Example of a complete template configuration for cluster creation
      • Add a machine
        • Create a machine using CLI
        • Create a machine using MOSK management console
        • Assign L2 templates to machines
        • Deploy a machine to a specific bare-metal host
        • Override network interfaces naming and order
        • Request a static IP address for a machine
        • Manually allocate IP addresses for bare-metal hosts
      • Add a Ceph cluster
    • Deploy OpenStack
      • Deploy an OpenStack cluster
      • Advanced OpenStack configuration (optional)
        • Enable LVM ephemeral storage
        • Enable LVM block storage
        • Enable SR-IOV with OVS/OVN
        • Enable IPsec encryption for east-west traffic
        • Enable Cinder backend for Glance
        • Enable Cinder volume encryption
        • Advanced configuration for OpenStack compute nodes
          • Configuration recommendations for compute node types
          • Configure the CPU model
          • Enable huge pages for OpenStack
          • Configure CPU isolation for a compute node
          • Configure custom CPU topologies
          • Configure PCI passthrough for guests
          • Configure initial resource oversubscription
          • Limit HW resources for hyperconverged OpenStack compute nodes
          • Configure GPU virtualization
        • Configure LoadBalancer for PowerDNS
      • Access OpenStack after deployment
        • Configure DNS to access OpenStack
        • Access your OpenStack environment
      • Troubleshoot an OpenStack deployment
        • Debugging the Helm releases
        • Debugging the OpenStack Controller
        • Debugging the OsDpl CR
        • OpenStack support dump
    • Deploy OpenSDN
      • OpenSDN deployment prerequisites
      • Deploy OpenSDN
      • Advanced OpenSDN configuration
        • Enable huge pages for OpenStack with Tungsten Fabric
        • Enable SR-IOV for OpenSDN
        • Configure multiple Contrail API workers
      • Troubleshoot the OpenSDN deployment
        • Enable debug logs for the Tungsten Fabric services
        • Troubleshoot access to the OpenSDN web UI
        • Disable TX offloading on NICs used by vRouter
  • Operations Guide
    • Cluster update
      • Update to a major version
      • Update to a patch version
      • Verify the management cluster status before MOSK update
      • Change the upgrade order of a machine
      • Configure the parallel update of worker nodes
      • Create update groups for worker machines
      • Granularly update MOSK using the ClusterUpdatePlan object
      • Configure update auto-pause
    • Configure backups of the Kubernetes underlay
      • Create backups of the Kubernetes underlay
      • Restore the Kubernetes underlay from a backup
    • Getting access
      • Generate a kubeconfig for a MOSK cluster using API
      • Access the management console
      • Connect to a MOSK cluster
      • Access the Keycloak Admin Console
      • Access the OpenSDN web UI
    • OpenStack operations
      • Migrate public endpoints to Envoy Proxy
      • Migrate networking from Open vSwitch to Open Virtual Network
        • Migration limitations and impact
        • Prepare environment for migration
        • Perform pre-migration verification
        • Adjust security groups to allow access to DHCP and Metadata
        • Adjust MTU for VXLAN tenant networks
        • Adjust DNS servers for subnets
        • Perform migration
        • Verification and cleanup
      • Upgrade OpenStack
      • Backup and restore OpenStack databases
        • Enable OpenStack database remote backups
        • Manually trigger an OpenStack database backup
        • Verify the backup jobs for the OpenStack database
        • Restore OpenStack databases from a backup
      • Add a controller node
      • Replace a failed controller node
      • Add a compute node
      • Change oversubscription settings for existing compute nodes
      • Configure NVLink topology-aware scheduling of multi-GPU instances
      • Delete a compute node
      • Run Tempest tests
      • Remove an OpenStack cluster
      • Remove an OpenStack service
      • Enable uploading of an image through Horizon with untrusted SSL certificates
      • Rotate OpenStack credentials
      • Customize OpenStack container images
      • Troubleshoot orphaned resource allocations
      • Start monitoring IP address capacity
      • Rotate Octavia Amphora (LBaaS) certificates
      • Enroll a bare-metal node with Redfish Virtual Media
      • Access Tenant Telemetry services
    • OpenStack services configuration
      • Configure high availability with Masakari
      • Verify the Instance HA service
      • Configure monitoring of cloud workload availability
    • Ceph operations
      • Configuration Reference
        • Helm chart configuration
        • ConfigMap pelagia-lcmconfig
      • CephDeployment operations
        • Ceph resources management
          • Enable management of Ceph tolerations and resources
          • Verify Ceph tolerations and resources
        • Ceph user credentials
          • Manage Ceph RBD or CephFS clients
          • Manage Ceph Object Storage users
        • Configure Ceph Shared File System (CephFS)
        • Ceph default configuration
        • Share Ceph across two clusters
        • Migrate Ceph pools from one failure domain to another
        • Enable Ceph multinetwork
        • Ceph Object Storage
          • Enable Ceph RADOS Gateway Object Storage
          • Enable Multisite for Ceph Object Storage
          • Configure Ceph Object Storage server-side encryption
          • Configure Ceph Object Gateway TLS
          • RADOS Gateway bucket policy
            • Create Ceph Object Storage users
            • Set a bucket policy for a Ceph Object Storage user
            • Set a bucket policy for OpenStack users
        • Enable Ceph RBD mirroring
        • Specify Rook daemons placement
      • Ceph cluster lifecycle management
        • Automated lifecycle management
          • Create a Ceph OSD remove task
          • Add, remove, or reconfigure Ceph nodes
          • Add, remove, or reconfigure Ceph OSDs
          • Add, remove, or reconfigure Ceph OSDs with metadata devices
          • Replace a failed Ceph node
          • Replace a failed Ceph OSD
          • Replace a failed metadata device
          • Replace a failed Ceph OSD disk with a metadata device as a device name
          • Replace a failed Ceph OSD with a metadata device as a logical volume path
        • Increase Ceph cluster storage size
        • Remove Ceph OSD manually
        • Move a Ceph Monitor daemon to another node
        • Move Ceph Monitor before node replacement
      • Rockoon integration
        • Integrate Pelagia with Rockoon
        • Configure Ceph pools for Cinder multiple backends
        • Calculate target ratios for Ceph pools for Rockoon
      • Verify Ceph
        • Verify the Ceph core services
        • Verify Ceph cluster state
        • Verify Pelagia Controllers and Rook Ceph Operator
        • Verify rook-discover
    • StackLight operations
      • Configure StackLight
        • StackLight configuration procedure
        • StackLight configuration parameters
        • Verify StackLight after configuration
      • Tune OpenSearch performance
      • Export logs from OpenSearch
        • Export logs from OpenSearch Dashboards to CSV
        • Export logs from OpenSearch using elasticdump
      • OpenSearch Dashboards
        • View OpenSearch Dashboards
        • Search in OpenSearch Dashboards
      • View Grafana dashboards
      • Create custom dashboards in Grafana
      • Export data from Table panels of Grafana dashboards to CSV
      • StackLight alerts
        • OpenStack
          • OpenStack system services
            • Libvirt
            • MariaDB
            • Memcached
            • Public API probes
            • RabbitMQ
            • SSL certificates
          • OpenStack core services
            • OpenStack services API
            • Cinder
            • Horizon
            • Neutron
            • Nova
            • Cloudprober
            • Portprober
            • PowerDNS
            • Credential rotation
          • OpenStack Controller (Rockoon)
        • OpenSDN
          • Cassandra
          • Redis
          • Tungsten Fabric Operator
          • OpenSDN
          • ZooKeeper
        • StackLight
          • Alertmanager
          • cAdvisor
          • Elasticsearch Exporter
          • Envoy proxy
          • Fluentd
          • General
          • Grafana
          • Monitoring of external endpoints
          • OpenSearch
          • PostgreSQL and Patroni
          • Prometheus
          • Prometheus MS Teams
          • Prometheus Relay
          • ServiceNow
          • Salesforce notifier
          • Telegraf
          • Telemeter
        • Ceph
        • Bare metal
          • Bond interface
          • Ironic
          • Kernel
          • Host Operating System Modules Controller
          • IPMI
        • Generic
          • Calico
          • Etcd
        • Kubernetes
          • Kubernetes applications
          • Kubernetes resources
          • Kubernetes storage
          • Kubernetes system
        • Keycloak
        • MOSK management
          • Helm Controller
          • MOSK management
          • MOSK management cache
          • MOSK management controllers
          • MOSK management providers
          • MOSK and MOSK management SSL
          • Release Controller
        • Mirantis Kubernetes Engine
        • k0s
        • Node
          • General
          • Node network
          • Node time
          • mdadm RAID
          • NUMA
        • Cross-node connectivity
      • Alert dependencies
      • Silence alerts
      • StackLight rules for Kubernetes network policies
      • Tune StackLight for long-term log retention
      • Enable log forwarding to external destinations
      • Enable remote logging to syslog
      • Create log-based metrics
      • Enable generic metric scraping
      • Manage metrics filtering
      • Use S.M.A.R.T. metrics for creating alert rules
      • Deschedule StackLight Pods from a worker machine
      • Tune Prometheus IPMI exporter
    • OpenSDN operations
      • Upgrade OpenSDN from 24.1 to 25.1
      • Update OpenSDN
      • Back up OpenSDN data
      • Restore OpenSDN data
      • Track OpenSDN node maintenance progress
      • Replace a failed OpenSDN controller node
      • Delete a vRouter node
      • Verify the OpenSDN deployment
      • Configure load balancing
      • Enable OpenSDN Cassandra repairs
      • Enable contrail-tools
      • Enable tf-api-cli
    • Bare-metal operations
      • Upgrade an operating system distribution
      • Automatic upgrade of a host operating system
      • Remove old Ubuntu kernel packages
      • Host operating system configuration
        • Host OS configuration management workflow
        • Global recommendations for implementation of custom modules
        • Format and structure of a module package
        • Modules provided by MOSK
        • Tune kernel parameters on OpenStack controller nodes
        • HostOSConfiguration and HostOSConfigurationModules concepts
        • Internal API for host OS configuration management
        • Add a custom module to a MOSK deployment
        • Test a custom or MOSK module after creation
        • Retrigger a module configuration
        • Troubleshooting
      • Migrate auditd settings from the Cluster object to the auditd module
      • Change a user name and password for a bare-metal host
      • Restart the inspection of a bare-metal host
      • Restart a bare-metal host
      • Replace a failed manager node
      • Modify network configuration on an existing machine
      • Add more racks to an existing MOSK cluster
      • Expand IP addresses capacity in an existing cluster
      • Enable network infrastructure monitoring
      • Run cluster self-diagnostics
        • Trigger self-diagnostics for a cluster
        • Self-upgrades of the Diagnostic Controller
        • Diagnostic checks for the bare-metal provider
    • IAM operations
      • Manage user roles through the MOSK management API
        • Available IAM roles and use cases
        • Mapping of Keycloak roles to IAM*RoleBinding objects
      • Manage user roles through the MOSK management console
      • Manage user roles through Keycloak
        • MOSK roles and scopes
        • Use cases
      • Change the password for Keycloak master user
      • Change passwords for IAM users
      • Obtain MariaDB credentials for IAM
      • Manage Keycloak truststore using the MOSK management console
    • Management cluster operations
      • MOSK management CLI
      • Workflow and configuration of management cluster upgrade
      • Schedule MOSK management updates
      • Renew the MOSK and MKE licenses
      • Configure NTP server
      • Automatically propagate Salesforce configuration to all clusters
      • Update the Keycloak IP address on management clusters
      • Configure host names for cluster machines
      • Back up MariaDB on a management cluster
        • Configure periodic backups of MariaDB
        • Verify operability of the MariaDB backup jobs
        • Restore MariaDB databases
        • Change the storage node for MariaDB
      • Remove a management cluster
      • Warm up the MOSK management cache
    • General operations
      • Change a cluster configuration
      • Enable cluster and machine maintenance mode
        • Enable maintenance mode on a cluster and machine using management console
        • Enable maintenance mode on a cluster and machine using CLI
      • Disable a machine
      • Move a Ceph Monitor daemon to another node during MOSK cluster maintenance
      • Perform a graceful reboot of a cluster
      • Delete a cluster machine
        • Precautions for a cluster machine deletion
        • Delete a cluster machine using the management console
        • Delete a cluster machine using CLI
      • Delete a MOSK cluster
      • Verify cluster status
      • Verify machine status
    • Underlay Kubernetes operations
      • Set the MTU size for Calico
      • Add or update a CA certificate for a MITM proxy using API
      • Configure TLS certificates for cluster applications
      • Force certificate renewal for Kubernetes components
      • Define a custom CA certificate for a private Docker registry
      • Increase memory limits for cluster components
      • Increase storage quota for etcd
      • Configure Kubernetes auditing and profiling
    • Limitations
  • Troubleshooting Guide
    • Collect cluster logs
    • Collect support dump
    • Inspect the history of a cluster and machine deployment or update
    • Management console is inaccessible during management cluster upgrade
    • Cluster deletion freezes
    • Keycloak admin console becomes inaccessible after changing the theme
    • MariaDB Pods fail to start after a non-graceful shutdown
    • The auditd events cause ‘backlog limit exceeded’ messages
    • The database space exceeded error on large clusters
    • Troubleshoot a management cluster bootstrap
      • Troubleshoot the bootstrap node configuration
        • DNS settings
        • Default network addresses
      • Troubleshoot the bootstrap region creation
      • Troubleshoot machine creation
      • Troubleshoot deployment stages
      • Collect the bootstrap logs
    • Troubleshoot OpenStack
      • The rfs-openstack-redis pod gets stuck in the Completed state
      • Kernel neighbor table overflow on OpenStack controller nodes in large clusters
    • Troubleshoot OpenSDN
      • External BGP peer receives large MPLS L3 VPN (VPNv4) table from OpenSDN
      • Unresponsive OpenSDN API due to excessive Cassandra tombstone records
      • The OpenSDN tf-config pods fail to process API calls
    • Troubleshoot bare metal
      • Log in to the IPA virtual console for hardware troubleshooting
      • Inspection error on bare-metal hosts after dnsmasq restart
      • Troubleshoot an operating system upgrade with host restart
      • Troubleshoot iPXE boot issues
      • Provisioning failure due to device naming issues in a bare-metal host profile
    • Troubleshoot management clusters
      • Pods get stuck during MariaDB operations
    • Troubleshoot Ceph
      • Ceph disaster recovery
      • The ceph-exporter pods are present in the Ceph crash list
      • Ceph Monitors recovery
      • Ceph Monitors store.db size rapidly growing
      • Replaced Ceph OSD fails to start on authorization
      • Ceph health reports PG_DAMAGED after a failed disk or node replacement
      • Ceph rebalancing gets stuck during disabled node removal
      • CephOsdRemoveTask failure with a timeout during rebalance
      • Ceph OSD experiencing slow operations in BlueStore
      • Maintenance stuck on a compact Ceph cluster
    • Troubleshoot StackLight
      • Patroni replication lag
      • Alertmanager does not send resolve notifications for custom alerts
      • Troubleshoot alerts
        • Troubleshoot cAdvisor alerts
        • Troubleshoot Helm Controller alerts
        • Troubleshoot Host Operating System Modules Controller alerts
        • Troubleshoot Ubuntu kernel alerts
        • Troubleshoot Kubernetes applications alerts
        • Troubleshoot Kubernetes resources alerts
        • Troubleshoot Kubernetes storage alerts
        • Troubleshoot Kubernetes system alerts
        • Troubleshoot MOSK management Exporter alerts
        • Troubleshoot Mirantis Kubernetes Engine alerts
        • Troubleshoot node alerts
        • Troubleshoot OpenSearch alerts
        • Troubleshoot Release Controller alerts
        • Troubleshoot Ceph alerts
        • Troubleshoot Telemeter client alerts
      • OpenSearchPVCMismatch alert raises due to the OpenSearch PVC size mismatch
      • OpenSearch cluster deadlock due to the corrupted index
      • Failure of shard relocation in the OpenSearch cluster
      • StackLight pods get stuck with the ‘NodeAffinity failed’ error
      • No logs are forwarded to Splunk
      • Troubleshoot high OpenSearch indexing pressure
    • Troubleshooting cluster update
      • Frequent node disconnections with mcc-keepalived forcing new election
  • API Reference
    • Management resources
      • General resources
        • PublicKey resource
        • License resource
        • TLSConfig resource
        • ContainerRegistry resource
        • MCCUpgrade resource
        • CacheWarmupRequest resource
      • IAM resources
        • IAMUser resource
        • IAMRole resource
        • IAMGlobalRoleBinding resource
        • IAMRoleBinding resource
        • IAMClusterRoleBinding resource
      • Cluster resources
        • BareMetalHost resource
        • BareMetalHostCredential resource
        • BareMetalHostInventory resource
        • BareMetalHostProfile resource
        • Cluster resource
        • Machine resource
      • Cluster lifecycle resources
        • Diagnostic resource
        • SupportDump resource
        • GracefulRebootRequest resource
        • ClusterUpdatePlan resource
        • UpdateGroup resource
        • UpdateAutoPause resource
        • Cluster backup resources
          • ClusterBackup resource
          • ClusterBackupSchedule resource
          • KeyEncryptionKey resource
          • RCloneCredential resource
      • Networking resources
        • IPaddr
        • IpamHost
        • L2Template
        • MetalLBConfig
        • MultiRackCluster
        • Rack
        • Subnet
      • Network infrastructure monitoring resources
        • InfraConnectivityMonitor
        • CheckerInventoryConfig
        • NetCheckerTargetsConfig
      • Host OS configuration resources
        • HostOSConfiguration
        • HostOSConfigurationModules
    • OpenStack Operator resources
    • OpenSDN Operator (TFOperator) resources
    • Ceph resources
      • CephDeployment custom resource
      • CephDeploymentHealth custom resource
      • CephDeploymentMaintenance custom resource
      • CephDeploymentSecret custom resource
      • CephOsdRemoveTask custom resource
    • StackLight resources
  • User Guide
    • Use the Instance HA service
    • Configure the introspective instance monitor
    • Manage application credentials
    • Authenticate in OpenStack API as a federated OIDC user
    • Use the Shared Filesystems service
      • Set up Shared Filesystems service with generic driver
      • Set up Shared Filesystems service with CephFS driver
    • Deploy your first cloud application using automation
    • Deploy your first cloud application using cloud web UI
    • Use Heat to create and manage OpenSDN objects
    • Use S3 API for MOSK Object Storage
    • Run Windows guests
    • Use the Dynamic Resource Balancer service
    • Use NVLink topology-aware scheduling for multi-GPU instances
    • Migrate instances
    • Configure network trunking in projects
    • Configure per-instance migration mode
    • Access the bare-metal node console
    • Configure VPN for cloud applications
  • Security Guide
    • CADF audit notifications in OpenStack services
    • Rotation of credentials in OpenStack
    • Firewall configuration
      • MOSK management
      • k0s
      • Mirantis Kubernetes Engine
      • StackLight
      • Ceph
      • MOSK
      • OpenStack
      • Tungsten Fabric
    • Cluster auditing
      • Host operating system
    • OpenStack API access policies
    • Data protection
      • Data encryption capabilities
      • Encryption of live migration data
      • Encryption of cloud control plane communications
    • Compliance
      • Federal Information Processing Standards (FIPS)
      • Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG)
        • DISA STIG compliance in MOSK
        • Apply DISA STIG hardening on host operating systems
    • Container images signing and validation
    • LBaaS certificate
    • Software Bill of Materials
      • Concepts and objectives
      • Compatible tools and ecosystem
      • Format of SBOM
  • FAQ

Release and Lifecycle Information

  • Release Notes
    • 26.2
      • New features
      • Known issues
      • Release artifacts
        • MOSK cluster artifacts
        • Management cluster artifacts
      • Addressed issues
      • Update notes
      • Security notes
  • Compatibility Matrix
    • MOSK cluster components compatibility
    • Management cluster components compatibility
    • Cluster versions compatibility
    • MOSK cluster update schema
  • Deprecation Notes
    • OpenStack
    • OpenSDN (Tungsten Fabric)
    • Bare metal
    • MOSK management
    • Ceph
    • StackLight
  • Release cadence and support cycle
  1. Home
  2. Operations Guide
  3. Ceph operations
  4. CephDeployment operations
  5. Ceph Object Storage
  6. RADOS Gateway bucket policy

RADOS Gateway bucket policy

This section provides Ceph procedures for Amazon S3 buckets and bucket policies.

  • Create Ceph Object Storage users
  • Set a bucket policy for a Ceph Object Storage user
  • Set a bucket policy for OpenStack users
Next
Create Ceph Object Storage users
Previous
Configure Ceph Object Gateway TLS

Mirantis Inc. 900 E Hamilton Avenue, Suite 650, Campbell, CA 95008 +1-650-963-9828

© 2005 - 2026 Mirantis, Inc. All rights reserved. "Mirantis" and "FUEL" are registered trademarks of Mirantis, Inc. All other trademarks are the property of their respective owners.