[RGW] Is there a way for a user to change is secret key or create other keys ?
Hello Cephers, I was using Ceph with OpenStack, and users could add, remove credentials with `openstack ec2 credentials` commands. But, we are moving our Object Storage service to a new cluster, and didn't want to tie it with OpenStack. Is there a way to have a bit of self service for Rados Gateway, at leas for creating, deleting, changing S3 keys ? It does not seem to be part of S3 APIs. It's certainly doable with Ceph RGW admin API, but with which tool that a standard user can use ? The Ceph Dashboard does not seem a good idea. Roles are global, nothing that can be scoped to a tenant. Some S3 browsers exist (https://github.com/nimbis/s3commander), but never with some management like changing S3 keys. Certainly because it's not in the "standard" S3 API. Perhaps Ceph can provide a client-side dashboard, which can be exposed externally, aside the actual admin dashboard, which will stay inside ? Regards, -- Gilles
On Mon, Oct 9, 2023 at 9:16 AM Gilles Mocellin <gilles.mocellin@nuagelibre.org> wrote:
Hello Cephers,
I was using Ceph with OpenStack, and users could add, remove credentials with `openstack ec2 credentials` commands. But, we are moving our Object Storage service to a new cluster, and didn't want to tie it with OpenStack.
Is there a way to have a bit of self service for Rados Gateway, at leas for creating, deleting, changing S3 keys ?
It does not seem to be part of S3 APIs.
right, user/role/key management is part of the IAM service in AWS, not S3. IAM exposes APIs like https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateAccessKey.html, etc radosgw supports some of the IAM APIs related to roles and role/user policy, but not the ones for self-service user/key management. i'd love to add those eventually once we have an s3 'account' feature to base them on, but development there has been slow (https://github.com/ceph/ceph/pull/46373 tracks the most recent progress) i'd agree that the radosgw admin APIs aren't a great fit because they're targeted at admins, rather than delegating self-service features to end users
It's certainly doable with Ceph RGW admin API, but with which tool that a standard user can use ?
The Ceph Dashboard does not seem a good idea. Roles are global, nothing that can be scoped to a tenant.
Some S3 browsers exist (https://github.com/nimbis/s3commander), but never with some management like changing S3 keys. Certainly because it's not in the "standard" S3 API.
Perhaps Ceph can provide a client-side dashboard, which can be exposed externally, aside the actual admin dashboard, which will stay inside ?
Regards, -- Gilles _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
Le lundi 9 octobre 2023, 17:12:53 CEST Casey Bodley a écrit :
On Mon, Oct 9, 2023 at 9:16 AM Gilles Mocellin
<gilles.mocellin@nuagelibre.org> wrote:
Hello Cephers,
I was using Ceph with OpenStack, and users could add, remove credentials with `openstack ec2 credentials` commands. But, we are moving our Object Storage service to a new cluster, and didn't want to tie it with OpenStack.
Is there a way to have a bit of self service for Rados Gateway, at leas for creating, deleting, changing S3 keys ?
It does not seem to be part of S3 APIs.
right, user/role/key management is part of the IAM service in AWS, not S3. IAM exposes APIs like https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateAccessKey.html , etc
radosgw supports some of the IAM APIs related to roles and role/user policy, but not the ones for self-service user/key management. i'd love to add those eventually once we have an s3 'account' feature to base them on, but development there has been slow (https://github.com/ceph/ceph/pull/46373 tracks the most recent progress)
i'd agree that the radosgw admin APIs aren't a great fit because they're targeted at admins, rather than delegating self-service features to end users
Thank you, glad to see it's something that someone already think about. I look at other authentication mechanisms, like LDAP, Keycloak, STS... And I don't think I understand every thing. As a great target, I'd like to build an IAM service, based on for example Keycloak. But what I understand from the documentation, everything around STS and Keycloak seems to be geared toward applications, which can negotiate tokens, and use short lived credentials ? Impossible to use some tools like rclone, restic, s3cmd, or existing apps that needs just one pair of static S3 access and secret keys ? LDAP can do that, but no way to add new keys, just modify the one we have, based on the login/password. It's already one step, but with some not intuitive tricks, to encode the login/password into a S3 access key... with an empty S3 secret key...
participants (2)
-
Casey Bodley
-
Gilles Mocellin