Ceph Object Gateway Config Reference

The following settings may added to the Ceph configuration file (i.e., usuallyceph.conf) under the [client.radosgw.{instance-name}] section. Thesettings may contain default values. If you do not specify each setting in theCeph configuration file, the default value will be set automatically.

Configuration variables set under the [client.radosgw.{instance-name}]section will not apply to rgw or radosgw-admin commands without an instance-namespecified in the command. Thus variables meant to be applied to all RGWinstances or all radosgw-admin commands can be put into the [global] or the[client] section to avoid specifying instance-name.

rgw frontends

  • Description

  • Configures the HTTP frontend(s). The configuration for multiplefrontends can be provided in a comma-delimited list. Each frontendconfiguration may include a list of options separated by spaces,where each option is in the form “key=value” or “key”. SeeHTTP Frontends for more on supported options.

  • Type

  • String

  • Default

  • beast port=7480

rgw data

  • Description

  • Sets the location of the data files for Ceph Object Gateway.

  • Type

  • String

  • Default

  • /var/lib/ceph/radosgw/$cluster-$id

rgw enable apis

  • Description
  • Enables the specified APIs.

Note

Enabling the s3 API is a requirement forany radosgw instance that is meant toparticipate in a multi-siteconfiguration.

  • Type

  • String

  • Default

  • s3, swift, swift_auth, admin All APIs.

rgw cache enabled

  • Description

  • Whether the Ceph Object Gateway cache is enabled.

  • Type

  • Boolean

  • Default

  • true

rgw cache lru size

  • Description

  • The number of entries in the Ceph Object Gateway cache.

  • Type

  • Integer

  • Default

  • 10000

rgw socket path

  • Description

  • The socket path for the domain socket. FastCgiExternalServeruses this socket. If you do not specify a socket path, CephObject Gateway will not run as an external server. The path youspecify here must be the same as the path specified in thergw.conf file.

  • Type

  • String

  • Default

  • N/A

rgw fcgi socket backlog

  • Description

  • The socket backlog for fcgi.

  • Type

  • Integer

  • Default

  • 1024

rgw host

  • Description

  • The host for the Ceph Object Gateway instance. Can be an IPaddress or a hostname.

  • Type

  • String

  • Default

  • 0.0.0.0

rgw port

  • Description

  • Port the instance listens for requests. If not specified,Ceph Object Gateway runs external FastCGI.

  • Type

  • String

  • Default

  • None

rgw dns name

  • Description

  • The DNS name of the served domain. See also the hostnames setting within regions.

  • Type

  • String

  • Default

  • None

rgw script uri

  • Description

  • The alternative value for the SCRIPT_URI if not setin the request.

  • Type

  • String

  • Default

  • None

rgw request uri

  • Description

  • The alternative value for the REQUEST_URI if not setin the request.

  • Type

  • String

  • Default

  • None

rgw print continue

  • Description

  • Enable 100-continue if it is operational.

  • Type

  • Boolean

  • Default

  • true

rgw remote addr param

  • Description

  • The remote address parameter. For example, the HTTP fieldcontaining the remote address, or the X-Forwarded-Foraddress if a reverse proxy is operational.

  • Type

  • String

  • Default

  • REMOTE_ADDR

rgw op thread timeout

  • Description

  • The timeout in seconds for open threads.

  • Type

  • Integer

  • Default

  • 600

rgw op thread suicide timeout

  • Description

  • The time timeout in seconds before a Ceph Object Gatewayprocess dies. Disabled if set to 0.

  • Type

  • Integer

  • Default

  • 0

rgw thread pool size

  • Description

  • The size of the thread pool.

  • Type

  • Integer

  • Default

  • 100 threads.

rgw num control oids

  • Description

  • The number of notification objects used for cache synchronizationbetween different rgw instances.

  • Type

  • Integer

  • Default

  • 8

rgw init timeout

  • Description

  • The number of seconds before Ceph Object Gateway gives up oninitialization.

  • Type

  • Integer

  • Default

  • 30

rgw mime types file

  • Description

  • The path and location of the MIME types. Used for Swiftauto-detection of object types.

  • Type

  • String

  • Default

  • /etc/mime.types

rgw gc max objs

  • Description

  • The maximum number of objects that may be handled bygarbage collection in one garbage collection processing cycle.

  • Type

  • Integer

  • Default

  • 32

rgw gc obj min wait

  • Description

  • The minimum wait time before the object may be removedand handled by garbage collection processing.

  • Type

  • Integer

  • Default

  • 2 * 3600

rgw gc processor max time

  • Description

  • The maximum time between the beginning of two consecutive garbagecollection processing cycles.

  • Type

  • Integer

  • Default

  • 3600

rgw gc processor period

  • Description

  • The cycle time for garbage collection processing.

  • Type

  • Integer

  • Default

  • 3600

rgw s3 success create obj status

  • Description

  • The alternate success status response for create-obj.

  • Type

  • Integer

  • Default

  • 0

rgw resolve cname

  • Description

  • Whether rgw should use DNS CNAME record of the requesthostname field (if hostname is not equal to rgw dns name).

  • Type

  • Boolean

  • Default

  • false

rgw obj stripe size

  • Description

  • The size of an object stripe for Ceph Object Gateway objects.See Architecture for details on striping.

  • Type

  • Integer

  • Default

  • 4 << 20

rgw extended http attrs

  • Description

  • Add new set of attributes that could be set on an entity(user, bucket or object). These extra attributes can be setthrough HTTP header fields when putting the entity or modifyingit using POST method. If set, these attributes will return asHTTP fields when doing GET/HEAD on the entity.

  • Type

  • String

  • Default

  • None

  • Example

  • “content_foo, content_bar, x-foo-bar”

rgw exit timeout secs

  • Description

  • Number of seconds to wait for a process before exitingunconditionally.

  • Type

  • Integer

  • Default

  • 120

rgw get obj window size

  • Description

  • The window size in bytes for a single object request.

  • Type

  • Integer

  • Default

  • 16 << 20

rgw get obj max req size

  • Description

  • The maximum request size of a single get operation sent to theCeph Storage Cluster.

  • Type

  • Integer

  • Default

  • 4 << 20

rgw relaxed s3 bucket names

  • Description

  • Enables relaxed S3 bucket names rules for US region buckets.

  • Type

  • Boolean

  • Default

  • false

rgw list buckets max chunk

  • Description

  • The maximum number of buckets to retrieve in a single operationwhen listing user buckets.

  • Type

  • Integer

  • Default

  • 1000

rgw override bucket index max shards

  • Description

  • Represents the number of shards for the bucket index object,a value of zero indicates there is no sharding. It is notrecommended to set a value too large (e.g. thousand) as itincreases the cost for bucket listing.This variable should be set in the client or global sectionsso that it is automatically applied to radosgw-admin commands.

  • Type

  • Integer

  • Default

  • 0

rgw curl wait timeout ms

  • Description

  • The timeout in milliseconds for certain curl calls.

  • Type

  • Integer

  • Default

  • 1000

rgw copy obj progress

  • Description

  • Enables output of object progress during long copy operations.

  • Type

  • Boolean

  • Default

  • true

rgw copy obj progress every bytes

  • Description

  • The minimum bytes between copy progress output.

  • Type

  • Integer

  • Default

  • 1024 * 1024

rgw admin entry

  • Description

  • The entry point for an admin request URL.

  • Type

  • String

  • Default

  • admin

rgw content length compat

  • Description

  • Enable compatibility handling of FCGI requests with both CONTENT_LENGTH AND HTTP_CONTENT_LENGTH set.

  • Type

  • Boolean

  • Default

  • false

rgw bucket quota ttl

  • Description

  • The amount of time in seconds cached quota information istrusted. After this timeout, the quota information will bere-fetched from the cluster.

  • Type

  • Integer

  • Default

  • 600

rgw user quota bucket sync interval

  • Description

  • The amount of time in seconds bucket quota information isaccumulated before syncing to the cluster. During this time,other RGW instances will not see the changes in bucket quotastats from operations on this instance.

  • Type

  • Integer

  • Default

  • 180

rgw user quota sync interval

  • Description

  • The amount of time in seconds user quota information isaccumulated before syncing to the cluster. During this time,other RGW instances will not see the changes in user quota statsfrom operations on this instance.

  • Type

  • Integer

  • Default

  • 180

rgw bucket default quota max objects

  • Description

  • Default max number of objects per bucket. Set on new users,if no other quota is specified. Has no effect on existing users.This variable should be set in the client or global sectionsso that it is automatically applied to radosgw-admin commands.

  • Type

  • Integer

  • Default

  • -1

rgw bucket default quota max size

  • Description

  • Default max capacity per bucket, in bytes. Set on new users,if no other quota is specified. Has no effect on existing users.

  • Type

  • Integer

  • Default

  • -1

rgw user default quota max objects

  • Description

  • Default max number of objects for a user. This includes allobjects in all buckets owned by the user. Set on new users,if no other quota is specified. Has no effect on existing users.

  • Type

  • Integer

  • Default

  • -1

rgw user default quota max size

  • Description

  • The value for user max size quota in bytes set on new users,if no other quota is specified. Has no effect on existing users.

  • Type

  • Integer

  • Default

  • -1

rgw verify ssl

  • Description

  • Verify SSL certificates while making requests.

  • Type

  • Boolean

  • Default

  • true

Multisite Settings

New in version Jewel.

You may include the following settings in your Ceph configurationfile under each [client.radosgw.{instance-name}] instance.

rgw zone

  • Description

  • The name of the zone for the gateway instance. If no zone isset, a cluster-wide default can be configured with the commandradosgw-admin zone default.

  • Type

  • String

  • Default

  • None

rgw zonegroup

  • Description

  • The name of the zonegroup for the gateway instance. If nozonegroup is set, a cluster-wide default can be configured withthe command radosgw-admin zonegroup default.

  • Type

  • String

  • Default

  • None

rgw realm

  • Description

  • The name of the realm for the gateway instance. If no realm isset, a cluster-wide default can be configured with the commandradosgw-admin realm default.

  • Type

  • String

  • Default

  • None

rgw run sync thread

  • Description

  • If there are other zones in the realm to sync from, spawn threadsto handle the sync of data and metadata.

  • Type

  • Boolean

  • Default

  • true

rgw data log window

  • Description

  • The data log entries window in seconds.

  • Type

  • Integer

  • Default

  • 30

rgw data log changes size

  • Description

  • The number of in-memory entries to hold for the data changes log.

  • Type

  • Integer

  • Default

  • 1000

rgw data log obj prefix

  • Description

  • The object name prefix for the data log.

  • Type

  • String

  • Default

  • data_log

rgw data log num shards

  • Description

  • The number of shards (objects) on which to keep thedata changes log.

  • Type

  • Integer

  • Default

  • 128

rgw md log max shards

  • Description

  • The maximum number of shards for the metadata log.

  • Type

  • Integer

  • Default

  • 64

Important

The values of rgw data log num shards andrgw md log max shards should not be changed after sync hasstarted.

S3 Settings

rgw s3 auth use ldap

  • Description

  • Should S3 authentication use LDAP.

  • Type

  • Boolean

  • Default

  • false

Swift Settings

rgw enforce swift acls

  • Description

  • Enforces the Swift Access Control List (ACL) settings.

  • Type

  • Boolean

  • Default

  • true

rgw swift token expiration

  • Description

  • The time in seconds for expiring a Swift token.

  • Type

  • Integer

  • Default

  • 24 * 3600

rgw swift url

  • Description

  • The URL for the Ceph Object Gateway Swift API.

  • Type

  • String

  • Default

  • None

rgw swift url prefix

For compatibility, setting this configuration variableto the empty string causes the default swift to beused; if you do want an empty prefix, set this option to/.

Warning

If you set this option to /, you mustdisable the S3 API by modifying rgwenable apis to exclude s3. It is notpossible to operate radosgw with rgwswift url prefix = / and simultaneouslysupport both the S3 and Swift APIs. If youdo need to support both APIs withoutprefixes, deploy multiple radosgw instancesto listen on different hosts (or ports)instead, enabling some for S3 and some forSwift.

  • Default

  • swift

  • Example

  • “/swift-testing”

rgw swift auth url

  • Description

  • Default URL for verifying v1 auth tokens (if not using internalSwift auth).

  • Type

  • String

  • Default

  • None

rgw swift auth entry

  • Description

  • The entry point for a Swift auth URL.

  • Type

  • String

  • Default

  • auth

rgw swift account in url

  • Description
  • Whether or not the Swift account name should be includedin the Swift API URL.

If set to false (the default), then the Swift APIwill listen on a URL formed likehttp://host:port/<rgw_swift_url_prefix>/v1, and theaccount name (commonly a Keystone project UUID ifradosgw is configured with Keystone integration) will be inferred from requestheaders.

If set to true, the Swift API URL will behttp://host:port/<rgw_swift_url_prefix>/v1/AUTH_<account_name&gt;(orhttp://host:port/<rgw_swift_url_prefix>/v1/AUTH_<keystone_project_id&gt;)instead, and the Keystone object-store endpoint mustaccordingly be configured to include theAUTH_%(tenant_id)s suffix.

You must set this option to true (and update theKeystone service catalog) if you want radosgw to supportpublicly-readable containers and temporary URLs.

  • Type

  • Boolean

  • Default

  • false

rgw swift versioning enabled

  • Description
  • Enables the Object Versioning of OpenStack Object Storage API.This allows clients to put the X-Versions-Location attributeon containers that should be versioned. The attribute specifiesthe name of container storing archived versions. It must be ownedby the same user that the versioned container due to accesscontrol verification - ACLs are NOT taken into consideration.Those containers cannot be versioned by the S3 object versioningmechanism.

A slightly different attribute, X-History-Location, which is also understood byOpenStack Swiftfor handling DELETE operations, is currently not supported.

  • Type

  • Boolean

  • Default

  • false

rgw trust forwarded https

  • Description

  • When a proxy in front of radosgw is used for ssl termination, radosgwdoes not know whether incoming http connections are secure. Enablethis option to trust the Forwarded and X-Forwarded-Proto headerssent by the proxy when determining whether the connection is secure.This is required for some features, such as server side encryption.

  • Type

  • Boolean

  • Default

  • false

Logging Settings

rgw log nonexistent bucket

  • Description

  • Enables Ceph Object Gateway to log a request for a non-existentbucket.

  • Type

  • Boolean

  • Default

  • false

rgw log object name

  • Description

  • The logging format for an object name. See manpagedate for details about format specifiers.

  • Type

  • Date

  • Default

  • %Y-%m-%d-%H-%i-%n

rgw log object name utc

  • Description

  • Whether a logged object name includes a UTC time.If false, it uses the local time.

  • Type

  • Boolean

  • Default

  • false

rgw usage max shards

  • Description

  • The maximum number of shards for usage logging.

  • Type

  • Integer

  • Default

  • 32

rgw usage max user shards

  • Description

  • The maximum number of shards used for a single user’susage logging.

  • Type

  • Integer

  • Default

  • 1

rgw enable ops log

  • Description

  • Enable logging for each successful Ceph Object Gateway operation.

  • Type

  • Boolean

  • Default

  • false

rgw enable usage log

  • Description

  • Enable the usage log.

  • Type

  • Boolean

  • Default

  • false

rgw ops log rados

  • Description

  • Whether the operations log should be written to theCeph Storage Cluster backend.

  • Type

  • Boolean

  • Default

  • true

rgw ops log socket path

  • Description

  • The Unix domain socket for writing operations logs.

  • Type

  • String

  • Default

  • None

rgw ops log data backlog

  • Description

  • The maximum data backlog data size for operations logs writtento a Unix domain socket.

  • Type

  • Integer

  • Default

  • 5 << 20

rgw usage log flush threshold

  • Description

  • The number of dirty merged entries in the usage log beforeflushing synchronously.

  • Type

  • Integer

  • Default

  • 1024

rgw usage log tick interval

  • Description

  • Flush pending usage log data every n seconds.

  • Type

  • Integer

  • Default

  • 30

rgw log http headers

  • Description

  • Comma-delimited list of HTTP headers to include with opslog entries. Header names are case insensitive, and usethe full header name with words separated by underscores.

  • Type

  • String

  • Default

  • None

  • Example

  • “http_x_forwarded_for, http_x_special_k”

rgw intent log object name

  • Description

  • The logging format for the intent log object name. See manpagedate for details about format specifiers.

  • Type

  • Date

  • Default

  • %Y-%m-%d-%i-%n

rgw intent log object name utc

  • Description

  • Whether the intent log object name includes a UTC time.If false, it uses the local time.

  • Type

  • Boolean

  • Default

  • false

Keystone Settings

rgw keystone url

  • Description

  • The URL for the Keystone server.

  • Type

  • String

  • Default

  • None

rgw keystone api version

  • Description

  • The version (2 or 3) of OpenStack Identity API that should beused for communication with the Keystone server.

  • Type

  • Integer

  • Default

  • 2

rgw keystone admin domain

  • Description

  • The name of OpenStack domain with admin privilege when usingOpenStack Identity API v3.

  • Type

  • String

  • Default

  • None

rgw keystone admin project

  • Description

  • The name of OpenStack project with admin privilege when usingOpenStack Identity API v3. If left unspecified, value ofrgw keystone admin tenant will be used instead.

  • Type

  • String

  • Default

  • None

rgw keystone admin token

  • Description

  • The Keystone admin token (shared secret). In Ceph RadosGWauthentication with the admin token has priority overauthentication with the admin credentials(rgw keystone admin user, rgw keystone admin password,rgw keystone admin tenant, rgw keystone admin project,rgw keystone admin domain). The Keystone admin tokenhas been deprecated, but can be used to integrate witholder environments. Prefer rgw keystone admin token pathto avoid exposing the token.

  • Type

  • String

  • Default

  • None

rgw keystone admin token path

  • Description

  • Path to a file containing the Keystone admin token(shared secret). In Ceph RadosGW authentication withthe admin token has priority over authentication withthe admin credentials(rgw keystone admin user, rgw keystone admin password,rgw keystone admin tenant, rgw keystone admin project,rgw keystone admin domain).The Keystone admin token has been deprecated, but can beused to integrate with older environments.

  • Type

  • String

  • Default

  • None

rgw keystone admin tenant

  • Description

  • The name of OpenStack tenant with admin privilege (Service Tenant) whenusing OpenStack Identity API v2

  • Type

  • String

  • Default

  • None

rgw keystone admin user

  • Description

  • The name of OpenStack user with admin privilege for Keystoneauthentication (Service User) when OpenStack Identity API v2

  • Type

  • String

  • Default

  • None

rgw keystone admin password

  • Description

  • The password for OpenStack admin user when using OpenStackIdentity API v2. Prefer rgw keystone admin password pathto avoid exposing the token.

  • Type

  • String

  • Default

  • None

rgw keystone admin password path

  • Description

  • Path to a file containing the password for OpenStackadmin user when using OpenStack Identity API v2.

  • Type

  • String

  • Default

  • None

rgw keystone accepted roles

  • Description

  • The roles requires to serve requests.

  • Type

  • String

  • Default

  • Member, admin

rgw keystone token cache size

  • Description

  • The maximum number of entries in each Keystone token cache.

  • Type

  • Integer

  • Default

  • 10000

rgw keystone revocation interval

  • Description

  • The number of seconds between token revocation checks.

  • Type

  • Integer

  • Default

  • 15 * 60

rgw keystone verify ssl

  • Description

  • Verify SSL certificates while making token requests to keystone.

  • Type

  • Boolean

  • Default

  • true

Server-side encryption Settings

rgw crypt s3 kms backend

  • Description

  • Where the SSE-KMS encryption keys are stored. Supported KMSsystems are OpenStack Barbican (barbican, the default) andHashiCorp Vault (vault).

  • Type

  • String

  • Default

  • None

Barbican Settings

rgw barbican url

  • Description

  • The URL for the Barbican server.

  • Type

  • String

  • Default

  • None

rgw keystone barbican user

  • Description

  • The name of the OpenStack user with access to the Barbicansecrets used for Encryption.

  • Type

  • String

  • Default

  • None

rgw keystone barbican password

  • Description

  • The password associated with the Barbican user.

  • Type

  • String

  • Default

  • None

rgw keystone barbican tenant

  • Description

  • The name of the OpenStack tenant associated with the Barbicanuser when using OpenStack Identity API v2.

  • Type

  • String

  • Default

  • None

rgw keystone barbican project

  • Description

  • The name of the OpenStack project associated with the Barbicanuser when using OpenStack Identity API v3.

  • Type

  • String

  • Default

  • None

rgw keystone barbican domain

  • Description

  • The name of the OpenStack domain associated with the Barbicanuser when using OpenStack Identity API v3.

  • Type

  • String

  • Default

  • None

HashiCorp Vault Settings

rgw crypt vault auth

  • Description

  • Type of authentication method to be used. The only methodcurrently supported is token.

  • Type

  • String

  • Default

  • token

rgw crypt vault token file

  • Description

  • If authentication method is token, provide a path to the tokenfile, which should be readable only by Rados Gateway.

  • Type

  • String

  • Default

  • None

rgw crypt vault addr

rgw crypt vault prefix

  • Description

  • The Vault secret URL prefix, which can be used to restrict accessto a particular subset of the secret space, e.g. /v1/secret/data.

  • Type

  • String

  • Default

  • None

rgw crypt vault secret engine

  • Description

  • Vault Secret Engine to be used to retrieve encryption keys: choosebetween kv-v2, transit.

  • Type

  • String

  • Default

  • None

rgw crypt vault namespace

  • Description

  • If set, Vault Namespace provides tenant isolation for teams and individualson the same Vault Enterprise instance, e.g. acme/tenant1

  • Type

  • String

  • Default

  • None

QoS settings

New in version Nautilus.

The civetweb frontend has a threading model that uses a thread perconnection and hence automatically throttled by rgw thread pool sizeconfigurable when it comes to accepting connections. The beast frontend isnot restricted by the thread pool size when it comes to accepting newconnections, so a scheduler abstraction is introduced in Nautilus release whichfor supporting ways for scheduling requests in the future.

Currently the scheduler defaults to a throttler which throttles the activeconnections to a configured limit. QoS based on mClock is currently in anexperimental phase and not recommended for production yet. Currentimplementation of dmclock_client op queue divides RGW Ops on admin, auth(swift auth, sts) metadata & data requests.

rgw max concurrent requests

  • Description

  • Maximum number of concurrent HTTP requests that the beast frontendwill process. Tuning this can help to limit memory usage underheavy load.

  • Type

  • Integer

  • Default

  • 1024

rgw scheduler type

  • Description
  • The type of RGW Scheduler to use. Valid values are throttler,dmclock. Currently defaults to throttler which throttles beastfrontend requests. dmclock is experimental and will need theexperimental flag set

The options below are to tune the experimental dmclock scheduler. For somefurther reading on dmclock, see QoS Based on mClock. op_class for the flags below isone of admin, auth, metadata or data.

rgwdmclock<op_class>_res

  • Description

  • The mclock reservation for op_class requests

  • Type

  • float

  • Default

  • 100.0

rgwdmclock<op_class>_wgt

  • Description

  • The mclock weight for op_class requests

  • Type

  • float

  • Default

  • 1.0

rgwdmclock<op_class>_lim

  • Description

  • The mclock limit for op_class requests

  • Type

  • float

  • Default

  • 0.0