Ceph Manager Dashboard

Overview

The original Ceph Manager Dashboard that was shipped with Ceph Luminous started out as a simple read-only view into various run-time information and performance data of a Ceph cluster. It used a very simple architecture to achieve the original goal. However, there was a growing demand for adding more web-based management capabilities, to make it easier to administer Ceph for users that prefer a WebUI over using the command line.

The new Ceph Manager Dashboard plugin is a replacement of the previous one and adds a built-in web based monitoring and administration application to the Ceph Manager. The architecture and functionality of this new plugin is derived from and inspired by the openATTIC Ceph management and monitoring tool. The development is actively driven by the team behind openATTIC at SUSE.

The intention is to reuse as much of the existing openATTIC functionality as possible, while adapting it to the different environment. openATTIC is based on Django and the Django REST Framework, whereas the dashboard plugin’s backend code uses the CherryPy framework and a custom REST API implementation. The WebUI implementation is based on Angular/TypeScript, merging both functionality from the original dashboard as well as adding new functionality originally developed for the standalone version of openATTIC. The Ceph Manager Dashboard plugin is implemented as a web application that visualizes information and statistics about the Ceph cluster using a web server hosted by ceph-mgr.

The dashboard currently provides the following features to monitor and manage various aspects of your Ceph cluster:

  • Multi-User and Role Management: The dashboard supports multiple user accounts with different permissions (roles). The user accounts and roles can be modified on both the command line and via the WebUI. See User and Role Management for details.
  • SSL/TLS support: All HTTP communication between the web browser and the dashboard is secured via SSL. A self-signed certificate can be created with a built-in command, but it’s also possible to import custom certificates signed and issued by a CA. See SSL/TLS Support for details.
  • Overall cluster health: Displays the overall cluster status, storage utilization (e.g. number of objects, raw capacity, usage per pool), a list of pools and their status and usage statistics.
  • Cluster logs: Display the latest updates to the cluster’s event and audit log files.
  • Hosts: Provides a list of all hosts associated to the cluster, which services are running and which version of Ceph is installed.
  • Performance counters: Displays detailed service-specific statistics for each running service.
  • Monitors: Lists all MONs, their quorum status, open sessions.
  • Configuration Reference: Lists all available configuration options, their description and default values.
  • Pools: List all Ceph pools and their details (e.g. applications, placement groups, replication size, EC profile, CRUSH ruleset, etc.)
  • OSDs: Lists all OSDs, their status and usage statistics as well as detailed information like attributes (OSD map), metadata, performance counters and usage histograms for read/write operations.
  • iSCSI: Lists all hosts that run the TCMU runner service, displaying all images and their performance characteristics (read/write ops, traffic).
  • RBD: Lists all RBD images and their properties (size, objects, features). Create, copy, modify and delete RBD images. Create, delete and rollback snapshots of selected images, protect/unprotect these snapshots against modification. Copy or clone snapshots, flatten cloned images.
  • RBD mirroring: Lists all active sync daemons and their status, pools and RBD images including their synchronization state.
  • CephFS: Lists all active filesystem clients and associated pools, including their usage statistics.
  • Object Gateway: Lists all active object gateways and their performance counters. Display and manage (add/edit/delete) object gateway users and their details (e.g. quotas) as well as the users’ buckets and their details (e.g. owner, quotas).

Enabling

Within a running Ceph cluster, the Ceph Manager Dashboard is enabled with:

$ ceph mgr module enable dashboard

Configuration

SSL/TLS Support

All HTTP connections to the dashboard are secured with SSL/TLS by default.

To get the dashboard up and running quickly, you can generate and install a self-signed certificate using the following built-in command:

$ ceph dashboard create-self-signed-cert

Note that most web browsers will complain about such self-signed certificates and require explicit confirmation before establishing a secure connection to the dashboard.

To properly secure a deployment and to remove the certificate warning, a certificate that is issued by a certificate authority (CA) should be used.

For example, a key pair can be generated with a command similar to:

$ openssl req -new -nodes -x509 \
  -subj "/O=IT/CN=ceph-mgr-dashboard" -days 3650 \
  -keyout dashboard.key -out dashboard.crt -extensions v3_ca

The dashboard.crt file should then be signed by a CA. Once that is done, you can enable it for all Ceph manager instances by running the following commands:

$ ceph config-key set mgr mgr/dashboard/crt -i dashboard.crt
$ ceph config-key set mgr mgr/dashboard/key -i dashboard.key

If different certificates are desired for each manager instance for some reason, the name of the instance can be included as follows (where $name is the name of the ceph-mgr instance, usually the hostname):

$ ceph config-key set mgr/dashboard/$name/crt -i dashboard.crt
$ ceph config-key set mgr/dashboard/$name/key -i dashboard.key

SSL can also be disabled by setting this configuration value:

$ ceph config set mgr mgr/dashboard/ssl false

This might be useful if the dashboard will be running behind a proxy which does not support SSL for its upstream servers or other situations where SSL is not wanted or required.

Warning

Use caution when disabling SSL as usernames and passwords will be sent to the dashboard unencrypted.

Note

You need to restart the Ceph manager processes manually after changing the SSL certificate and key. This can be accomplished by either running ceph mgr fail mgr or by disabling and re-enabling the dashboard module (which also triggers the manager to respawn itself):

$ ceph mgr module disable dashboard
$ ceph mgr module enable dashboard

Host name and port

Like most web applications, dashboard binds to a TCP/IP address and TCP port.

By default, the ceph-mgr daemon hosting the dashboard (i.e., the currently active manager) will bind to TCP port 8443 or 8080 when SSL is disabled.

If no specific address has been configured, the web app will bind to ::, which corresponds to all available IPv4 and IPv6 addresses.

These defaults can be changed via the configuration key facility on a cluster-wide level (so they apply to all manager instances) as follows:

$ ceph config set mgr mgr/dashboard/server_addr $IP
$ ceph config set mgr mgr/dashboard/server_port $PORT

Since each ceph-mgr hosts its own instance of dashboard, it may also be necessary to configure them separately. The IP address and port for a specific manager instance can be changed with the following commands:

$ ceph config set mgr mgr/dashboard/$name/server_addr $IP
$ ceph config set mgr mgr/dashboard/$name/server_port $PORT

Replace $name with the ID of the ceph-mgr instance hosting the dashboard web app.

Note

The command ceph mgr services will show you all endpoints that are currently configured. Look for the dashboard key to obtain the URL for accessing the dashboard.

Username and password

In order to be able to log in, you need to create a user account and associate it with at least one role. We provide a set of predefined system roles that you can use. For more details please refer to the User and Role Management section.

To create a user with the administrator role you can use the following commands:

$ ceph dashboard ac-user-create <username> <password> administrator

Enabling the Object Gateway management frontend

To use the Object Gateway management functionality of the dashboard, you will need to provide the login credentials of a user with the system flag enabled.

If you do not have a user which shall be used for providing those credentials, you will also need to create one:

$ radosgw-admin user create --uid=<user_id> --display-name=<display_name> \
    --system

Take note of the keys access_key and secret_key in the output of this command.

The credentials of an existing user can also be obtained by using radosgw-admin:

$ radosgw-admin user info --uid=<user_id>

Finally, provide the credentials to the dashboard:

$ ceph dashboard set-rgw-api-access-key <access_key>
$ ceph dashboard set-rgw-api-secret-key <secret_key>

This is all you have to do to get the Object Gateway management functionality working. The host and port of the Object Gateway are determined automatically.

If multiple zones are used, it will automatically determine the host within the master zone group and master zone. This should be sufficient for most setups, but in some circumstances you might want to set the host and port manually:

$ ceph dashboard set-rgw-api-host <host>
$ ceph dashboard set-rgw-api-port <port>

In addition to the settings mentioned so far, the following settings do also exist and you may find yourself in the situation that you have to use them:

$ ceph dashboard set-rgw-api-scheme <scheme>  # http or https
$ ceph dashboard set-rgw-api-admin-resource <admin_resource>
$ ceph dashboard set-rgw-api-user-id <user_id>

If you are using a self-signed certificate in your Object Gateway setup, then you should disable certificate verification in the dashboard to avoid refused connections, e.g. caused by certificates signed by unknown CA or not matching the host name:

$ ceph dashboard set-rgw-api-ssl-verify False

If the Object Gateway takes too long to process requests and the dashboard runs into timeouts, then you can set the timeout value to your needs:

$ ceph dashboard set-rest-requests-timeout <seconds>

The default value is 45 seconds.

Enabling the Embedding of Grafana Dashboards

Grafana and Prometheus are likely going to be bundled and installed by some orchestration tools along Ceph in the near future, but currently, you will have to install and configure both manually. After you have installed Prometheus and Grafana on your preferred hosts, proceed with the following steps.

  1. Enable the Ceph Exporter which comes as Ceph Manager module by running:

    $ ceph mgr module enable prometheus
    

More details can be found on the documentation of the prometheus module.

  1. Add the corresponding scrape configuration to Prometheus. This may look like:

    global:
      scrape_interval: 5s
    
    scrape_configs:
      - job_name: 'prometheus'
        static_configs:
          - targets: ['localhost:9090']
      - job_name: 'ceph'
        static_configs:
          - targets: ['localhost:9283']
      - job_name: 'node-exporter'
        static_configs:
          - targets: ['localhost:9100']
    
  2. Add Prometheus as data source to Grafana

  3. Install the vonage-status-panel and grafana-piechart-panel plugins using:

    grafana-cli plugins install vonage-status-panel
    grafana-cli plugins install grafana-piechart-panel
    
  4. Add the Dashboards to Grafana:

    Dashboards can be added to Grafana by importing dashboard jsons. Following command can be used for downloading json files:

    wget https://raw.githubusercontent.com/ceph/ceph/master/monitoring/grafana/dashboards/<Dashboard-name>.json
    

    You can find all the dashboard jsons here .

    For Example, for ceph-cluster overview you can use:

    wget https://raw.githubusercontent.com/ceph/ceph/master/monitoring/grafana/dashboards/ceph-cluster.json
    
  5. Configure Grafana in /etc/grafana/grafana.ini to adapt anonymous mode:

    [auth.anonymous]
    enabled = true
    org_name = Main Org.
    org_role = Viewer
    

After you have set up Grafana and Prometheus, you will need to configure the connection information that the Ceph Manager Dashboard will use to access Grafana.

You need to tell the dashboard on which url Grafana instance is running/deployed:

$ ceph dashboard set-grafana-api-url <grafana-server-url>  # default: ''

The format of url is : <protocol>:<IP-address>:<port> You can directly access Grafana Instance as well to monitor your cluster.

Enabling Single Sign-On (SSO)

The Ceph Manager Dashboard supports external authentication of users via the SAML 2.0 protocol. You need to create the user accounts and associate them with the desired roles first, as authorization is still performed by the Dashboard. However, the authentication process can be performed by an existing Identity Provider (IdP).

Note

Ceph Dashboard SSO support relies on onelogin’s python-saml library. Please ensure that this library is installed on your system, either by using your distribution’s package management or via Python’s pip installer.

To configure SSO on Ceph Dashboard, you should use the following command:

$ ceph dashboard sso setup saml2 <ceph_dashboard_base_url> <idp_metadata> {<idp_username_attribute>} {<idp_entity_id>} {<sp_x_509_cert>} {<sp_private_key>}

Parameters:

  • <ceph_dashboard_base_url>: Base URL where Ceph Dashboard is accessible (e.g., https://cephdashboard.local)
  • <idp_metadata>: URL, file path or content of the IdP metadata XML (e.g., https://myidp/metadata)
  • <idp_username_attribute> (optional): Attribute that should be used to get the username from the authentication response. Defaults to uid.
  • <idp_entity_id> (optional): Use this when more than one entity id exists on the IdP metadata.
  • <sp_x_509_cert> / <sp_private_key> (optional): File path or content of the certificate that should be used by Ceph Dashboard (Service Provider) for signing and encryption.

To display the current SAML 2.0 configuration, use the following command:

$ ceph dashboard sso show saml2

Note

For more information about onelogin_settings, please check the onelogin documentation.

To disable SSO:

$ ceph dashboard sso disable

To check if SSO is enabled:

$ ceph dashboard sso status

To enable SSO:

$ ceph dashboard sso enable saml2

Accessing the dashboard

You can now access the dashboard using your (JavaScript-enabled) web browser, by pointing it to any of the host names or IP addresses and the selected TCP port where a manager instance is running: e.g., httpS://<$IP>:<$PORT>/.

You should then be greeted by the dashboard login page, requesting your previously defined username and password. Select the Keep me logged in checkbox if you want to skip the username/password request when accessing the dashboard in the future.

User and Role Management

User Accounts

Ceph Dashboard supports managing multiple user accounts. Each user account consists of a username, a password (stored in encrypted form using bcrypt), an optional name, and an optional email address.

User accounts are stored in MON’s configuration database, and are globally shared across all ceph-mgr instances.

We provide a set of CLI commands to manage user accounts:

  • Show User(s):

    $ ceph dashboard ac-user-show [<username>]
    
  • Create User:

    $ ceph dashboard ac-user-create <username> [<password>] [<rolename>] [<name>] [<email>]
    
  • Delete User:

    $ ceph dashboard ac-user-delete <username>
    
  • Change Password:

    $ ceph dashboard ac-user-set-password <username> <password>
    
  • Modify User (name, and email):

    $ ceph dashboard ac-user-set-info <username> <name> <email>
    

User Roles and Permissions

User accounts are also associated with a set of roles that define which dashboard functionality can be accessed by the user.

The Dashboard functionality/modules are grouped within a security scope. Security scopes are predefined and static. The current available security scopes are:

  • hosts: includes all features related to the Hosts menu entry.
  • config-opt: includes all features related to management of Ceph configuration options.
  • pool: includes all features related to pool management.
  • osd: includes all features related to OSD management.
  • monitor: includes all features related to Monitor management.
  • rbd-image: includes all features related to RBD image management.
  • rbd-mirroring: includes all features related to RBD-Mirroring management.
  • iscsi: includes all features related to iSCSI management.
  • rgw: includes all features related to Rados Gateway management.
  • cephfs: includes all features related to CephFS management.
  • manager: include all features related to Ceph Manager management.
  • log: include all features related to Ceph logs management.
  • grafana: include all features related to Grafana proxy.
  • dashboard-settings: allows to change dashboard settings.

A role specifies a set of mappings between a security scope and a set of permissions. There are four types of permissions:

  • read
  • create
  • update
  • delete

See below for an example of a role specification based on a Python dictionary:

# example of a role
{
  'role': 'my_new_role',
  'description': 'My new role',
  'scopes_permissions': {
    'pool': ['read', 'create'],
    'rbd-image': ['read', 'create', 'update', 'delete']
  }
}

The above role dictates that a user has read and create permissions for features related to pool management, and has full permissions for features related to RBD image management.

The Dashboard already provides a set of predefined roles that we call system roles, and can be used right away in a fresh Ceph Dashboard installation.

The list of system roles are:

  • administrator: provides full permissions for all security scopes.
  • read-only: provides read permission for all security scopes except the dashboard settings.
  • block-manager: provides full permissions for rbd-image, rbd-mirroring, and iscsi scopes.
  • rgw-manager: provides full permissions for the rgw scope
  • cluster-manager: provides full permissions for the hosts, osd, monitor, manager, and config-opt scopes.
  • pool-manager: provides full permissions for the pool scope.
  • cephfs-manager: provides full permissions for the cephfs scope.

The list of currently available roles can be retrieved by the following command:

$ ceph dashboard ac-role-show [<rolename>]

It is also possible to create new roles using CLI commands. The available commands to manage roles are the following:

  • Create Role:

    $ ceph dashboard ac-role-create <rolename> [<description>]
    
  • Delete Role:

    $ ceph dashboard ac-role-delete <rolename>
    
  • Add Scope Permissions to Role:

    $ ceph dashboard ac-role-add-scope-perms <rolename> <scopename> <permission> [<permission>...]
    
  • Delete Scope Permission from Role:

    $ ceph dashboard ac-role-del-perms <rolename> <scopename>
    

To associate roles to users, the following CLI commands are available:

  • Set User Roles:

    $ ceph dashboard ac-user-set-roles <username> <rolename> [<rolename>...]
    
  • Add Roles To User:

    $ ceph dashboard ac-user-add-roles <username> <rolename> [<rolename>...]
    
  • Delete Roles from User:

    $ ceph dashboard ac-user-del-roles <username> <rolename> [<rolename>...]
    

Example of user and custom role creation

In this section we show a full example of the commands that need to be used in order to create a user account, that should be able to manage RBD images, view and create Ceph pools, and have read-only access to any other scopes.

  1. Create the user:

    $ ceph dashboard ac-user-create bob mypassword
    
  2. Create role and specify scope permissions:

    $ ceph dashboard ac-role-create rbd/pool-manager
    $ ceph dashboard ac-role-add-scope-perms rbd/pool-manager rbd-image read create update delete
    $ ceph dashboard ac-role-add-scope-perms rbd/pool-manager pool read create
    
  3. Associate roles to user:

    $ ceph dashboard ac-user-set-roles bob rbd/pool-manager read-only
    

Reverse proxies

If you are accessing the dashboard via a reverse proxy configuration, you may wish to service it under a URL prefix. To get the dashboard to use hyperlinks that include your prefix, you can set the url_prefix setting:

ceph config set mgr mgr/dashboard/url_prefix $PREFIX

so you can access the dashboard at http://$IP:$PORT/$PREFIX/.

Auditing

The REST API is capable of logging PUT, POST and DELETE requests to the Ceph audit log. This feature is disabled by default, but can be enabled with the following command:

$ ceph dashboard set-audit-api-enabled <true|false>

If enabled, the following parameters are logged per each request:

  • from - The origin of the request, e.g. https://[::1]:44410
  • path - The REST API path, e.g. /api/auth
  • method - e.g. PUT, POST or DELETE
  • user - The name of the user, otherwise ‘None’

The logging of the request payload (the arguments and their values) is enabled by default. Execute the following command to disable this behaviour:

$ ceph dashboard set-audit-api-log-payload <true|false>

A log entry may look like this:

2018-10-22 15:27:01.302514 mgr.x [INF] [DASHBOARD] from='https://[::ffff:127.0.0.1]:37022' path='/api/rgw/user/klaus' method='PUT' user='admin' params='{"max_buckets": "1000", "display_name": "Klaus Mustermann", "uid": "klaus", "suspended": "0", "email": "klaus.mustermann@ceph.com"}'