I see, I think the problem is the virtual_ip field which has an incorrect value: virtual_ip: ceph.example.com (INCORRECT) This field has to be set to the virtual_ip, and that's explains why you end up with this entry in the internal PROMETHEUS_API_HOST. The config has to be: =========================== service_type: mgmt-gateway spec: virtual_ip: 10.128.8.255 ssl: true ssl_cert: ... ssl_key: ... --- service_type: ingress service_id: mgmt-gateway virtual_ip: 10.128.8.255/22 backend_service: mgmt-gateway keepalive_only: true =========================== As explained in the docs: https://docs.ceph.com/en/latest/cephadm/services/mgmt-gateway/ Note: Just to confirm the "/22" in the ingress part is correct and you have to keep it otherwise ingress wont work correctly On Fri, Sep 18, 2026 at 11:09 AM Robert Sander <r.sander@heinlein-support.de> wrote:
Hi,
we have now removed the mgmt-gateway service.
We came to the conclusion that it is not production ready yet. The certificates do not match.
I am using this service spec:
service_type: mgmt-gateway service_name: mgmt-gateway placement: label: mgmt-gateway spec: port: 443 virtual_ip: ceph.example.com ssl: true ssl_cert: |- -----BEGIN CERTIFICATE----- XXXX -----END CERTIFICATE----- ssl_key: |- -----BEGIN PRIVATE KEY----- XXXX -----END PRIVATE KEY----- --- service_type: ingress service_id: mgmt-gateway placement: label: mgmt-gateway virtual_ip: 10.128.8.255/22 backend_service: mgmt-gateway keepalive_only: true
ceph.example.com has an A record that resolves to 10.128.8.255. The provided certificate contains a subjectAlternativeName for ceph.example.com.
The browser is able to open https://ceph.example.com
ceph dashboard set-grafana-frontend-api-url https://ceph.example.com/grafana/
The browser is able to open Grafana.
But Grafana is not able to reach Prometheus.
mgr/dashboard/PROMETHEUS_API_HOST is set to https://ceph.example.com:29443/internal/prometheus which works but the certificate at this port does not.
Bu the nginx gets an internal certificate configured on Port 29443 that was signed by the certmgr's internal CA and contains the hostname where the daemon is deployed in the subjectAlternativeName attribute.
It should have ceph.example.com in subjectAlternativeName as this is the name for the service IP and is set in PROMETHEUS_API_HOST.
Regards -- Robert Sander Linux Consultant
Heinlein Consulting GmbH Schwedter Str. 8/9b, 10119 Berlin <https://www.google.com/maps/search/Schwedter+Str.+8%2F9b,+10119+Berlin?entry=gmail&source=g>
https://www.heinlein-support.de
Tel: +49 30 405051 <+49%2030%20405051> - 0 Fax: +49 30 405051 - 19 <+49%2030%2040505119>
Amtsgericht Berlin-Charlottenburg - HRB 220009 B Geschäftsführer: Peer Heinlein - Sitz: Berlin