Using the Ceph Management gateway (mgmt-gateway)

The Ceph Management gateway (mgmt-gateway) service provides a modular, service-based architecture design.cephadm manages the mgmt-gateway service, which is built on top of nginx. This gateway acts as the front-end and single entry point to the Ceph cluster, providing unified access to all Ceph applications, including the Ceph Dashboard and the monitoring stack.

Using nginx enhances security and simplifies access management due to its robust community support and high-security standards. The mgmt-gateway service acts as a reverse proxy that routes requests to the appropriate Ceph application instances. Use the mgmt-gateway either by itself or with the OAuth2 Proxy service for authentication to enable single-sign on (SSO) access to the Ceph Dashboard. For more information about the OAuth2 Proxy service, see Using the OAuth2 Proxy (oauth2-proxy) service.

Using the Ceph Management gateway provides multiple benefits.
Unified access
Consolidated access through nginx improves security and provide a single entry point to services.
Improved user experience
Users no longer needs to keep track of where each application is running (IP or host).
High availability for Ceph Dashboard
nginx high availability (HA) mechanisms are used to provide high availability for the Ceph Dashboard.
High availability for monitoring
nginx high availability mechanisms are used to provide high availability for monitoring.
High availability for mg mt-gateway
Users can have continuous access to Ceph management tools, such as the Ceph Dashboard, Prometheus, Grafana, and Alertmanager, by enabling high availability (HA) for the Ceph Management gateway (mgmt-gateway). For more information about enabling high availability (HA) for the Ceph Management gateway, see Enabling high availability for Ceph Management gateway
Deploying the mgmt-gateway provides enhanced security. Once the mgmt-gateway service is deployed users cannot access monitoring services without authentication through the Ceph Dashboard. After the service is deployed, Prometheus, Grafana, and Alertmanager applications are accessible through links on the Ceph Dashboard. To get to the application links, go to Administration > Services on the Ceph Dashboard.
Note: In mgmt-gateway mode, Prometheus and Alertmanager require the user to define a unique username and password. The default is admin:admin. If OAuth2-proxy SSO is not enabled, the user must manually define these credentials.

nginx HA mechanisms are used to provide high availability for all the Ceph management applications including the Ceph Dashboard and monitoring stack. The mgmt-gateway service handles manager failover transparently and redirects the user to the active manager.

With monitoring, the Ceph Management service takes care of handling HA when several instances of Prometheus, Alertmanager or Grafana are available. The reverse proxy automatically detects healthy instances and uses them to process user requests.
Important: Design high availability configurations carefully to avoid introducing single points of failure.

Ceph Management gateway limitations

Using the mgmt-gateway service has the following limitations:
  • Services must bind to the appropriate ports based on the applications being proxied. Ensure that there are no port conflicts that might disrupt service availability.
  • The mgmt-gateway service internally makes use of the nginx reverse proxy.
    Use the following to find the default container image is used by default: 
    DEFAULT_NGINX_IMAGE = 'quay.io/ceph/NGINX_IMAGE'
    Storage administrators can change the image being used by changing the container_image_nginxcephadmmodule option. If other daemons were running, you must redeploy the daemons to use the new image. 
    ceph config set mgr mgr/cephadm/container_image_nginx NEW_NGINX_IMAGE
ceph orch redeploy mgmt-gateway