Hi, I'm trying to configure my rgw with keycloak, according to the documentation I need to modify /etc/ceph/ceph.conf Is they are anyway to configure the RGW with keycloak WITHOUT modifying this file ? Like using ceph config set or event in /etc/ceph/rgw.conf (or whatever) I ask that because my ceph.conf are manage with some deployment tools (puppet in my case). Regards JAS -- Albert SHIH 🦫 🐸 France Heure locale/Local time: lun. 09 juin 2025 22:37:23 CEST
Hi Albert, you can use puppet to set ceph conf commands. # Disable RadosGW access logs exec { 'set-debug_rgw_access': command => 'ceph config set client.rgw debug_rgw_access 0', unless => 'ceph config get client.rgw debug_rgw_access | grep -w 0', path => ['/usr/bin', '/bin'], require => Package['ceph-common'], } I also managed the ceph.conf a long time with puppet. It is just an ini file. If you use the ceph orchestrator, you can define most, if not all, parameters in the service definition: https://docs.ceph.com/en/quincy/cephadm/services/rgw/ Another thing, that comes to my mind is to generate a dedicated config for the rgw daemon and start the rgw daemon with the dedicated ceph config file. Maybe you can also set CLI parameter, but I never looked into that. Am Mo., 9. Juni 2025 um 22:45 Uhr schrieb Albert Shih <Albert.Shih@obspm.fr
:
Hi,
I'm trying to configure my rgw with keycloak, according to the documentation I need to modify
/etc/ceph/ceph.conf
Is they are anyway to configure the RGW with keycloak WITHOUT modifying this file ? Like using
ceph config set
or event in
/etc/ceph/rgw.conf (or whatever)
I ask that because my ceph.conf are manage with some deployment tools (puppet in my case).
Regards
JAS -- Albert SHIH 🦫 🐸 France Heure locale/Local time: lun. 09 juin 2025 22:37:23 CEST _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
-- Die Selbsthilfegruppe "UTF-8-Probleme" trifft sich diesmal abweichend im groüen Saal.
Le 10/06/2025 à 10:02:40+0200, Boris a écrit Him
you can use puppet to set ceph conf commands. # Disable RadosGW access logs exec { 'set-debug_rgw_access': command => 'ceph config set client.rgw debug_rgw_access 0', unless => 'ceph config get client.rgw debug_rgw_access | grep -w 0', path => ['/usr/bin', '/bin'], require => Package['ceph-common'], }
Ok. I already do that for other thing. I just didn't know if I can do that (vs put everything in ceph.conf).
I also managed the ceph.conf a long time with puppet. It is just an ini file.
If you use the ceph orchestrator, you can define most, if not all, parameters in the service definition: https://docs.ceph.com/en/quincy/cephadm/services/rgw/
OK good to know.
Another thing, that comes to my mind is to generate a dedicated config for the rgw daemon and start the rgw daemon with the dedicated ceph config file. Maybe you can also set CLI parameter, but I never looked into that.
I have big preference for the ceph config set method. So I would try that. Thanks. Regards -- Albert SHIH 🦫 🐸 Observatoire de Paris France Heure locale/Local time: mar. 10 juin 2025 13:14:07 CEST
I use Puppet for my complex servers, but my Ceph machines are lightweight, and Puppet, for all its virtues does require a Puppet agent to be installed on each target and have a corresponding node manifest. For the Ceph machines I just use Ansible. Since all my /etc/ceph files are identical on all machines, I can define a set of hosts to Ansible as belonging to a "ceph" group, and add/remove as needed, then use Ansible to update them /en masse/. Ansible requires no additional software on its targets to act as agents, as it simply directs operations via ssh. I don't have special /etc/ceph files for my rgw hosts, as since at least Octopus on, the pertinent information is in Ceph's configuration database and the actual contents of /etc/ceph are minimal. Ansible simply clones its master copy of /etc/ceph to each ceph target. On 6/10/25 07:15, Albert Shih wrote:
Le 10/06/2025 à 10:02:40+0200, Boris a écrit Him
you can use puppet to set ceph conf commands. # Disable RadosGW access logs exec { 'set-debug_rgw_access': command => 'ceph config set client.rgw debug_rgw_access 0', unless => 'ceph config get client.rgw debug_rgw_access | grep -w 0', path => ['/usr/bin', '/bin'], require => Package['ceph-common'], } Ok. I already do that for other thing. I just didn't know if I can do that (vs put everything in ceph.conf).
I also managed the ceph.conf a long time with puppet. It is just an ini file.
If you use the ceph orchestrator, you can define most, if not all, parameters in the service definition: https://docs.ceph.com/en/quincy/cephadm/services/rgw/ OK good to know.
Another thing, that comes to my mind is to generate a dedicated config for the rgw daemon and start the rgw daemon with the dedicated ceph config file. Maybe you can also set CLI parameter, but I never looked into that. I have big preference for the ceph config set method. So I would try that.
Thanks.
Regards
Le 10/06/2025 à 09:56:34-0400, Tim Holloway a écrit Hi,
I use Puppet for my complex servers, but my Ceph machines are lightweight, and Puppet, for all its virtues does require a Puppet agent to be installed on each target and have a corresponding node manifest.
For the Ceph machines I just use Ansible. Since all my /etc/ceph files are identical on all machines, I can define a set of hosts to Ansible as belonging to a "ceph" group, and add/remove as needed, then use Ansible to update them /en masse/. Ansible requires no additional software on its targets to act as agents, as it simply directs operations via ssh.
I don't have special /etc/ceph files for my rgw hosts, as since at least Octopus on, the pertinent information is in Ceph's configuration database and the actual contents of /etc/ceph are minimal. Ansible simply clones its master copy of /etc/ceph to each ceph target.
Fabulous. I 100% agree with you about puppet + ceph. I will not use ansible...because we don't have ansible currently. I'm using puppet for some minimal configuration on CEPH, mostly monitoring, version of ceph, stuff like that. The module I wrote just bootstrap the ceph with ceph adm. When I upgrade the ceph version the puppet module just install the new version of cephadm (and apt depot config) the rest is done manually. and of course the configuration of ceph is manual. If some day ceph auth will accept some JSON/YAML in export/import I will manage the export on cephfs with puppet. But not the case currently. Thanks. -- Albert SHIH 🦫 🐸 Observatoire de Paris France Heure locale/Local time: mar. 10 juin 2025 16:49:46 CEST
The other nice thing about Ansible is that you only need to install it on one machine. Which doesn't even have to be a server machine if you'd prefer to have a sysop machine run it instead. I have 2-3 boxes that can run ansible using playbooks that are stored/shared in the Ceph filesystem. The ansible core is fairly lightweight and it should be all you need these days to copy config files, execute ceph commands and even run cephadm upgrades. All the ceph machines themselves need is an ssh login capable of sudoing to (or being) whatever userid you administer ceph under, and likely can use the same security resources as you're using with ceph itself. I'm pretty sure you can feed ceph auth with YAML these days, though. It would send the info to the ceph config database, not /etc/ceph. The Ceph dashboard is also capable of doing a lot of the config and control work for ceph and there are ReST APIs for some of that stuff. if Puppet is your shop's master control point, nothing wrong with that. I merely offer additional options. Puppet is how I manage my site DHCP, DNS, and web proxy services, which are too gnarly for me to want to do in Ansible. But, as I said, for lightweight stuff, I skip Puppet. Actually to bring up a complex box on cold iron, I boot via Kickstart, run Ansible, which does basic common setup including installing Puppet agents where needed, then use Puppet for the heavy config work. On 6/10/25 10:54, Albert Shih wrote:
Le 10/06/2025 à 09:56:34-0400, Tim Holloway a écrit Hi,
I use Puppet for my complex servers, but my Ceph machines are lightweight, and Puppet, for all its virtues does require a Puppet agent to be installed on each target and have a corresponding node manifest.
For the Ceph machines I just use Ansible. Since all my /etc/ceph files are identical on all machines, I can define a set of hosts to Ansible as belonging to a "ceph" group, and add/remove as needed, then use Ansible to update them /en masse/. Ansible requires no additional software on its targets to act as agents, as it simply directs operations via ssh.
I don't have special /etc/ceph files for my rgw hosts, as since at least Octopus on, the pertinent information is in Ceph's configuration database and the actual contents of /etc/ceph are minimal. Ansible simply clones its master copy of /etc/ceph to each ceph target. Fabulous.
I 100% agree with you about puppet + ceph.
I will not use ansible...because we don't have ansible currently.
I'm using puppet for some minimal configuration on CEPH, mostly monitoring, version of ceph, stuff like that. The module I wrote just bootstrap the ceph with ceph adm.
When I upgrade the ceph version the puppet module just install the new version of cephadm (and apt depot config) the rest is done manually. and of course the configuration of ceph is manual.
If some day ceph auth will accept some JSON/YAML in export/import I will manage the export on cephfs with puppet. But not the case currently.
Thanks.
participants (3)
-
Albert Shih
-
Boris
-
Tim Holloway