ceph/doc/radosgw/config-ref.rst

   1 ======================================
   2  Ceph Object Gateway Config Reference
   3 ======================================
   4
   5 The following settings may added to the Ceph configuration file (i.e., usually
   6 ``ceph.conf``) under the ``[client.radosgw.{instance-name}]`` section. The
   7 settings may contain default values. If you do not specify each setting in the
   8 Ceph configuration file, the default value will be set automatically.
   9
  10 Configuration variables set under the ``[client.radosgw.{instance-name}]``
  11 section will not apply to rgw or radosgw-admin commands without an instance-name
  12 specified in the command. Thus variables meant to be applied to all RGW
  13 instances or all radosgw-admin commands can be put into the ``[global]`` or the
  14 ``[client]`` section to avoid specifying instance-name.
  15
  16 ``rgw frontends``
  17
  18 :Description: Configures the HTTP frontend(s). The configuration for multiple
  19               frontends can be provided in a comma-delimited list. Each frontend
  20               configuration may include a list of options separated by spaces,
  21               where each option is in the form "key=value" or "key". See
  22               `HTTP Frontends`_ for more on supported options.
  23
  24 :Type: String
  25 :Default: ``beast port=7480``
  26
  27 ``rgw data``
  28
  29 :Description: Sets the location of the data files for Ceph Object Gateway.
  30 :Type: String
  31 :Default: ``/var/lib/ceph/radosgw/$cluster-$id``
  32
  33
  34 ``rgw enable apis``
  35
  36 :Description: Enables the specified APIs.
  37
  38               .. note:: Enabling the ``s3`` API is a requirement for
  39                         any radosgw instance that is meant to
  40                         participate in a `multi-site <../multisite>`_
  41                         configuration.
  42 :Type: String
  43 :Default: ``s3, swift, swift_auth, admin`` All APIs.
  44
  45
  46 ``rgw cache enabled``
  47
  48 :Description: Whether the Ceph Object Gateway cache is enabled.
  49 :Type: Boolean
  50 :Default: ``true``
  51
  52
  53 ``rgw cache lru size``
  54
  55 :Description: The number of entries in the Ceph Object Gateway cache.
  56 :Type: Integer
  57 :Default: ``10000``
  58
  59
  60 ``rgw socket path``
  61
  62 :Description: The socket path for the domain socket. ``FastCgiExternalServer``
  63               uses this socket. If you do not specify a socket path, Ceph
  64               Object Gateway will not run as an external server. The path you
  65               specify here must be the same as the path specified in the
  66               ``rgw.conf`` file.
  67
  68 :Type: String
  69 :Default: N/A
  70
  71 ``rgw fcgi socket backlog``
  72
  73 :Description: The socket backlog for fcgi.
  74 :Type: Integer
  75 :Default: ``1024``
  76
  77 ``rgw host``
  78
  79 :Description: The host for the Ceph Object Gateway instance. Can be an IP
  80               address or a hostname.
  81
  82 :Type: String
  83 :Default: ``0.0.0.0``
  84
  85
  86 ``rgw port``
  87
  88 :Description: Port the instance listens for requests. If not specified,
  89               Ceph Object Gateway runs external FastCGI.
  90
  91 :Type: String
  92 :Default: None
  93
  94
  95 ``rgw dns name``
  96
  97 :Description: The DNS name of the served domain. See also the ``hostnames`` setting within regions.
  98 :Type: String
  99 :Default: None
 100
 101
 102 ``rgw script uri``
 103
 104 :Description: The alternative value for the ``SCRIPT_URI`` if not set
 105               in the request.
 106
 107 :Type: String
 108 :Default: None
 109
 110
 111 ``rgw request uri``
 112
 113 :Description: The alternative value for the ``REQUEST_URI`` if not set
 114               in the request.
 115
 116 :Type: String
 117 :Default: None
 118
 119
 120 ``rgw print continue``
 121
 122 :Description: Enable ``100-continue`` if it is operational.
 123 :Type: Boolean
 124 :Default: ``true``
 125
 126
 127 ``rgw remote addr param``
 128
 129 :Description: The remote address parameter. For example, the HTTP field
 130               containing the remote address, or the ``X-Forwarded-For``
 131               address if a reverse proxy is operational.
 132
 133 :Type: String
 134 :Default: ``REMOTE_ADDR``
 135
 136
 137 ``rgw op thread timeout``
 138
 139 :Description: The timeout in seconds for open threads.
 140 :Type: Integer
 141 :Default: 600
 142
 143
 144 ``rgw op thread suicide timeout``
 145
 146 :Description: The time ``timeout`` in seconds before a Ceph Object Gateway
 147               process dies. Disabled if set to ``0``.
 148
 149 :Type: Integer
 150 :Default: ``0``
 151
 152
 153 ``rgw thread pool size``
 154
 155 :Description: The size of the thread pool.
 156 :Type: Integer
 157 :Default: 100 threads.
 158
 159
 160 ``rgw num control oids``
 161
 162 :Description: The number of notification objects used for cache synchronization
 163               between different ``rgw`` instances.
 164
 165 :Type: Integer
 166 :Default: ``8``
 167
 168
 169 ``rgw init timeout``
 170
 171 :Description: The number of seconds before Ceph Object Gateway gives up on
 172               initialization.
 173
 174 :Type: Integer
 175 :Default: ``30``
 176
 177
 178 ``rgw mime types file``
 179
 180 :Description: The path and location of the MIME types. Used for Swift
 181               auto-detection of object types.
 182
 183 :Type: String
 184 :Default: ``/etc/mime.types``
 185
 186
 187 ``rgw s3 success create obj status``
 188
 189 :Description: The alternate success status response for ``create-obj``.
 190 :Type: Integer
 191 :Default: ``0``
 192
 193
 194 ``rgw resolve cname``
 195
 196 :Description: Whether ``rgw`` should use DNS CNAME record of the request
 197               hostname field (if hostname is not equal to ``rgw dns name``).
 198
 199 :Type: Boolean
 200 :Default: ``false``
 201
 202
 203 ``rgw obj stripe size``
 204
 205 :Description: The size of an object stripe for Ceph Object Gateway objects.
 206               See `Architecture`_ for details on striping.
 207
 208 :Type: Integer
 209 :Default: ``4 << 20``
 210
 211
 212 ``rgw extended http attrs``
 213
 214 :Description: Add new set of attributes that could be set on an entity
 215               (user, bucket or object). These extra attributes can be set
 216               through HTTP header fields when putting the entity or modifying
 217               it using POST method. If set, these attributes will return as
 218               HTTP  fields when doing GET/HEAD on the entity.
 219
 220 :Type: String
 221 :Default: None
 222 :Example: "content_foo, content_bar, x-foo-bar"
 223
 224
 225 ``rgw exit timeout secs``
 226
 227 :Description: Number of seconds to wait for a process before exiting
 228               unconditionally.
 229
 230 :Type: Integer
 231 :Default: ``120``
 232
 233
 234 ``rgw get obj window size``
 235
 236 :Description: The window size in bytes for a single object request.
 237 :Type: Integer
 238 :Default: ``16 << 20``
 239
 240
 241 ``rgw get obj max req size``
 242
 243 :Description: The maximum request size of a single get operation sent to the
 244               Ceph Storage Cluster.
 245
 246 :Type: Integer
 247 :Default: ``4 << 20``
 248
 249
 250 ``rgw relaxed s3 bucket names``
 251
 252 :Description: Enables relaxed S3 bucket names rules for US region buckets.
 253 :Type: Boolean
 254 :Default: ``false``
 255
 256
 257 ``rgw list buckets max chunk``
 258
 259 :Description: The maximum number of buckets to retrieve in a single operation
 260               when listing user buckets.
 261
 262 :Type: Integer
 263 :Default: ``1000``
 264
 265
 266 ``rgw override bucket index max shards``
 267
 268 :Description: Represents the number of shards for the bucket index object,
 269               a value of zero indicates there is no sharding. It is not
 270               recommended to set a value too large (e.g. thousand) as it
 271               increases the cost for bucket listing.
 272               This variable should be set in the client or global sections
 273               so that it is automatically applied to radosgw-admin commands.
 274
 275 :Type: Integer
 276 :Default: ``0``
 277
 278
 279 ``rgw curl wait timeout ms``
 280
 281 :Description: The timeout in milliseconds for certain ``curl`` calls.
 282 :Type: Integer
 283 :Default: ``1000``
 284
 285
 286 ``rgw copy obj progress``
 287
 288 :Description: Enables output of object progress during long copy operations.
 289 :Type: Boolean
 290 :Default: ``true``
 291
 292
 293 ``rgw copy obj progress every bytes``
 294
 295 :Description: The minimum bytes between copy progress output.
 296 :Type: Integer
 297 :Default: ``1024 * 1024``
 298
 299
 300 ``rgw admin entry``
 301
 302 :Description: The entry point for an admin request URL.
 303 :Type: String
 304 :Default: ``admin``
 305
 306
 307 ``rgw content length compat``
 308
 309 :Description: Enable compatibility handling of FCGI requests with both CONTENT_LENGTH AND HTTP_CONTENT_LENGTH set.
 310 :Type: Boolean
 311 :Default: ``false``
 312
 313
 314 ``rgw bucket quota ttl``
 315
 316 :Description: The amount of time in seconds cached quota information is
 317               trusted.  After this timeout, the quota information will be
 318               re-fetched from the cluster.
 319 :Type: Integer
 320 :Default: ``600``
 321
 322
 323 ``rgw user quota bucket sync interval``
 324
 325 :Description: The amount of time in seconds bucket quota information is
 326               accumulated before syncing to the cluster.  During this time,
 327               other RGW instances will not see the changes in bucket quota
 328               stats from operations on this instance.
 329 :Type: Integer
 330 :Default: ``180``
 331
 332
 333 ``rgw user quota sync interval``
 334
 335 :Description: The amount of time in seconds user quota information is
 336               accumulated before syncing to the cluster.  During this time,
 337               other RGW instances will not see the changes in user quota stats
 338               from operations on this instance.
 339 :Type: Integer
 340 :Default: ``180``
 341
 342
 343 ``rgw bucket default quota max objects``
 344
 345 :Description: Default max number of objects per bucket. Set on new users,
 346               if no other quota is specified. Has no effect on existing users.
 347               This variable should be set in the client or global sections
 348               so that it is automatically applied to radosgw-admin commands.
 349 :Type: Integer
 350 :Default: ``-1``
 351
 352
 353 ``rgw bucket default quota max size``
 354
 355 :Description: Default max capacity per bucket, in bytes. Set on new users,
 356               if no other quota is specified. Has no effect on existing users.
 357 :Type: Integer
 358 :Default: ``-1``
 359
 360
 361 ``rgw user default quota max objects``
 362
 363 :Description: Default max number of objects for a user. This includes all
 364               objects in all buckets owned by the user. Set on new users,
 365               if no other quota is specified. Has no effect on existing users.
 366 :Type: Integer
 367 :Default: ``-1``
 368
 369
 370 ``rgw user default quota max size``
 371
 372 :Description: The value for user max size quota in bytes set on new users,
 373               if no other quota is specified.  Has no effect on existing users.
 374 :Type: Integer
 375 :Default: ``-1``
 376
 377
 378 ``rgw verify ssl``
 379
 380 :Description: Verify SSL certificates while making requests.
 381 :Type: Boolean
 382 :Default: ``true``
 383
 384
 385 Garbage Collection Settings
 386 ===========================
 387
 388 The Ceph Object Gateway allocates storage for new objects immediately.
 389
 390 The Ceph Object Gateway purges the storage space used for deleted and overwritten
 391 objects in the Ceph Storage cluster some time after the gateway deletes the
 392 objects from the bucket index. The process of purging the deleted object data
 393 from the Ceph Storage cluster is known as Garbage Collection or GC.
 394
 395 To view the queue of objects awaiting garbage collection, execute the following::
 396
 397   $ radosgw-admin gc list
 398
 399   Note: specify --include-all to list all entries, including unexpired
 400
 401 Garbage collection is a background activity that may
 402 execute continuously or during times of low loads, depending upon how the
 403 administrator configures the Ceph Object Gateway. By default, the Ceph Object
 404 Gateway conducts GC operations continuously. Since GC operations are a normal
 405 part of Ceph Object Gateway operations, especially with object delete
 406 operations, objects eligible for garbage collection exist most of the time.
 407
 408 Some workloads may temporarily or permanently outpace the rate of garbage
 409 collection activity. This is especially true of delete-heavy workloads, where
 410 many objects get stored for a short period of time and then deleted. For these
 411 types of workloads, administrators can increase the priority of garbage
 412 collection operations relative to other operations with the following
 413 configuration parameters.
 414
 415
 416 ``rgw gc max objs``
 417
 418 :Description: The maximum number of objects that may be handled by
 419               garbage collection in one garbage collection processing cycle.
 420               Please do not change this value after the first deployment.
 421
 422 :Type: Integer
 423 :Default: ``32``
 424
 425
 426 ``rgw gc obj min wait``
 427
 428 :Description: The minimum wait time before a deleted object may be removed
 429               and handled by garbage collection processing.
 430
 431 :Type: Integer
 432 :Default: ``2 * 3600``
 433
 434
 435 ``rgw gc processor max time``
 436
 437 :Description: The maximum time between the beginning of two consecutive garbage
 438               collection processing cycles.
 439
 440 :Type: Integer
 441 :Default: ``3600``
 442
 443
 444 ``rgw gc processor period``
 445
 446 :Description: The cycle time for garbage collection processing.
 447 :Type: Integer
 448 :Default: ``3600``
 449
 450 Multisite Settings
 451 ==================
 452
 453 .. versionadded:: Jewel
 454
 455 You may include the following settings in your Ceph configuration
 456 file under each ``[client.radosgw.{instance-name}]`` instance.
 457
 458
 459 ``rgw zone``
 460
 461 :Description: The name of the zone for the gateway instance. If no zone is
 462               set, a cluster-wide default can be configured with the command
 463               ``radosgw-admin zone default``.
 464 :Type: String
 465 :Default: None
 466
 467
 468 ``rgw zonegroup``
 469
 470 :Description: The name of the zonegroup for the gateway instance. If no
 471               zonegroup is set, a cluster-wide default can be configured with
 472               the command ``radosgw-admin zonegroup default``.
 473 :Type: String
 474 :Default: None
 475
 476
 477 ``rgw realm``
 478
 479 :Description: The name of the realm for the gateway instance. If no realm is
 480               set, a cluster-wide default can be configured with the command
 481               ``radosgw-admin realm default``.
 482 :Type: String
 483 :Default: None
 484
 485
 486 ``rgw run sync thread``
 487
 488 :Description: If there are other zones in the realm to sync from, spawn threads
 489               to handle the sync of data and metadata.
 490 :Type: Boolean
 491 :Default: ``true``
 492
 493
 494 ``rgw data log window``
 495
 496 :Description: The data log entries window in seconds.
 497 :Type: Integer
 498 :Default: ``30``
 499
 500
 501 ``rgw data log changes size``
 502
 503 :Description: The number of in-memory entries to hold for the data changes log.
 504 :Type: Integer
 505 :Default: ``1000``
 506
 507
 508 ``rgw data log obj prefix``
 509
 510 :Description: The object name prefix for the data log.
 511 :Type: String
 512 :Default: ``data_log``
 513
 514
 515 ``rgw data log num shards``
 516
 517 :Description: The number of shards (objects) on which to keep the
 518               data changes log.
 519
 520 :Type: Integer
 521 :Default: ``128``
 522
 523
 524 ``rgw md log max shards``
 525
 526 :Description: The maximum number of shards for the metadata log.
 527 :Type: Integer
 528 :Default: ``64``
 529
 530 .. important:: The values of ``rgw data log num shards`` and
 531    ``rgw md log max shards`` should not be changed after sync has
 532    started.
 533
 534 S3 Settings
 535 ===========
 536
 537 ``rgw s3 auth use ldap``
 538
 539 :Description: Should S3 authentication use LDAP.
 540 :Type: Boolean
 541 :Default: ``false``
 542
 543
 544 Swift Settings
 545 ==============
 546
 547 ``rgw enforce swift acls``
 548
 549 :Description: Enforces the Swift Access Control List (ACL) settings.
 550 :Type: Boolean
 551 :Default: ``true``
 552
 553
 554 ``rgw swift token expiration``
 555
 556 :Description: The time in seconds for expiring a Swift token.
 557 :Type: Integer
 558 :Default: ``24 * 3600``
 559
 560
 561 ``rgw swift url``
 562
 563 :Description: The URL for the Ceph Object Gateway Swift API.
 564 :Type: String
 565 :Default: None
 566
 567
 568 ``rgw swift url prefix``
 569
 570 :Description: The URL prefix for the Swift API, to distinguish it from
 571               the S3 API endpoint. The default is ``swift``, which
 572               makes the Swift API available at the URL
 573               ``http://host:port/swift/v1`` (or
 574               ``http://host:port/swift/v1/AUTH_%(tenant_id)s`` if
 575               ``rgw swift account in url`` is enabled).
 576
 577               For compatibility, setting this configuration variable
 578               to the empty string causes the default ``swift`` to be
 579               used; if you do want an empty prefix, set this option to
 580               ``/``.
 581
 582               .. warning:: If you set this option to ``/``, you must
 583                            disable the S3 API by modifying ``rgw
 584                            enable apis`` to exclude ``s3``. It is not
 585                            possible to operate radosgw with ``rgw
 586                            swift url prefix = /`` and simultaneously
 587                            support both the S3 and Swift APIs. If you
 588                            do need to support both APIs without
 589                            prefixes, deploy multiple radosgw instances
 590                            to listen on different hosts (or ports)
 591                            instead, enabling some for S3 and some for
 592                            Swift.
 593 :Default: ``swift``
 594 :Example: "/swift-testing"
 595
 596
 597 ``rgw swift auth url``
 598
 599 :Description: Default URL for verifying v1 auth tokens (if not using internal
 600               Swift auth).
 601
 602 :Type: String
 603 :Default: None
 604
 605
 606 ``rgw swift auth entry``
 607
 608 :Description: The entry point for a Swift auth URL.
 609 :Type: String
 610 :Default: ``auth``
 611
 612
 613 ``rgw swift account in url``
 614
 615 :Description: Whether or not the Swift account name should be included
 616               in the Swift API URL.
 617
 618               If set to ``false`` (the default), then the Swift API
 619               will listen on a URL formed like
 620               ``http://host:port/<rgw_swift_url_prefix>/v1``, and the
 621               account name (commonly a Keystone project UUID if
 622               radosgw is configured with `Keystone integration
 623               <../keystone>`_) will be inferred from request
 624               headers.
 625
 626               If set to ``true``, the Swift API URL will be
 627               ``http://host:port/<rgw_swift_url_prefix>/v1/AUTH_<account_name>``
 628               (or
 629               ``http://host:port/<rgw_swift_url_prefix>/v1/AUTH_<keystone_project_id>``)
 630               instead, and the Keystone ``object-store`` endpoint must
 631               accordingly be configured to include the
 632               ``AUTH_%(tenant_id)s`` suffix.
 633
 634               You **must** set this option to ``true`` (and update the
 635               Keystone service catalog) if you want radosgw to support
 636               publicly-readable containers and `temporary URLs
 637               <../swift/tempurl>`_.
 638 :Type: Boolean
 639 :Default: ``false``
 640
 641
 642 ``rgw swift versioning enabled``
 643
 644 :Description: Enables the Object Versioning of OpenStack Object Storage API.
 645               This allows clients to put the ``X-Versions-Location`` attribute
 646               on containers that should be versioned. The attribute specifies
 647               the name of container storing archived versions. It must be owned
 648               by the same user that the versioned container due to access
 649               control verification - ACLs are NOT taken into consideration.
 650               Those containers cannot be versioned by the S3 object versioning
 651               mechanism.
 652
 653               A slightly different attribute, ``X-History-Location``, which is also understood by
 654               `OpenStack Swift <https://docs.openstack.org/swift/latest/api/object_versioning.html>`_
 655               for handling ``DELETE`` operations, is currently not supported.
 656 :Type: Boolean
 657 :Default: ``false``
 658
 659
 660 ``rgw trust forwarded https``
 661
 662 :Description: When a proxy in front of radosgw is used for ssl termination, radosgw
 663               does not know whether incoming http connections are secure. Enable
 664               this option to trust the ``Forwarded`` and ``X-Forwarded-Proto`` headers
 665               sent by the proxy when determining whether the connection is secure.
 666               This is required for some features, such as server side encryption.
 667 :Type: Boolean
 668 :Default: ``false``
 669
 670
 671
 672 Logging Settings
 673 ================
 674
 675
 676 ``rgw log nonexistent bucket``
 677
 678 :Description: Enables Ceph Object Gateway to log a request for a non-existent
 679               bucket.
 680
 681 :Type: Boolean
 682 :Default: ``false``
 683
 684
 685 ``rgw log object name``
 686
 687 :Description: The logging format for an object name. See manpage
 688               :manpage:`date` for details about format specifiers.
 689
 690 :Type: Date
 691 :Default: ``%Y-%m-%d-%H-%i-%n``
 692
 693
 694 ``rgw log object name utc``
 695
 696 :Description: Whether a logged object name includes a UTC time.
 697               If ``false``, it uses the local time.
 698
 699 :Type: Boolean
 700 :Default: ``false``
 701
 702
 703 ``rgw usage max shards``
 704
 705 :Description: The maximum number of shards for usage logging.
 706 :Type: Integer
 707 :Default: ``32``
 708
 709
 710 ``rgw usage max user shards``
 711
 712 :Description: The maximum number of shards used for a single user's
 713               usage logging.
 714
 715 :Type: Integer
 716 :Default: ``1``
 717
 718
 719 ``rgw enable ops log``
 720
 721 :Description: Enable logging for each successful Ceph Object Gateway operation.
 722 :Type: Boolean
 723 :Default: ``false``
 724
 725
 726 ``rgw enable usage log``
 727
 728 :Description: Enable the usage log.
 729 :Type: Boolean
 730 :Default: ``false``
 731
 732
 733 ``rgw ops log rados``
 734
 735 :Description: Whether the operations log should be written to the
 736               Ceph Storage Cluster backend.
 737
 738 :Type: Boolean
 739 :Default: ``true``
 740
 741
 742 ``rgw ops log socket path``
 743
 744 :Description: The Unix domain socket for writing operations logs.
 745 :Type: String
 746 :Default: None
 747
 748
 749 ``rgw ops log data backlog``
 750
 751 :Description: The maximum data backlog data size for operations logs written
 752               to a Unix domain socket.
 753
 754 :Type: Integer
 755 :Default: ``5 << 20``
 756
 757
 758 ``rgw usage log flush threshold``
 759
 760 :Description: The number of dirty merged entries in the usage log before
 761               flushing synchronously.
 762
 763 :Type: Integer
 764 :Default: 1024
 765
 766
 767 ``rgw usage log tick interval``
 768
 769 :Description: Flush pending usage log data every ``n`` seconds.
 770 :Type: Integer
 771 :Default: ``30``
 772
 773
 774 ``rgw log http headers``
 775
 776 :Description: Comma-delimited list of HTTP headers to include with ops
 777               log entries.  Header names are case insensitive, and use
 778               the full header name with words separated by underscores.
 779
 780 :Type: String
 781 :Default: None
 782 :Example: "http_x_forwarded_for, http_x_special_k"
 783
 784
 785 ``rgw intent log object name``
 786
 787 :Description: The logging format for the intent log object name. See manpage
 788               :manpage:`date` for details about format specifiers.
 789
 790 :Type: Date
 791 :Default: ``%Y-%m-%d-%i-%n``
 792
 793
 794 ``rgw intent log object name utc``
 795
 796 :Description: Whether the intent log object name includes a UTC time.
 797               If ``false``, it uses the local time.
 798
 799 :Type: Boolean
 800 :Default: ``false``
 801
 802
 803
 804 Keystone Settings
 805 =================
 806
 807
 808 ``rgw keystone url``
 809
 810 :Description: The URL for the Keystone server.
 811 :Type: String
 812 :Default: None
 813
 814
 815 ``rgw keystone api version``
 816
 817 :Description: The version (2 or 3) of OpenStack Identity API that should be
 818               used for communication with the Keystone server.
 819 :Type: Integer
 820 :Default: ``2``
 821
 822
 823 ``rgw keystone admin domain``
 824
 825 :Description: The name of OpenStack domain with admin privilege when using
 826               OpenStack Identity API v3.
 827 :Type: String
 828 :Default: None
 829
 830
 831 ``rgw keystone admin project``
 832
 833 :Description: The name of OpenStack project with admin privilege when using
 834               OpenStack Identity API v3. If left unspecified, value of
 835               ``rgw keystone admin tenant`` will be used instead.
 836 :Type: String
 837 :Default: None
 838
 839
 840 ``rgw keystone admin token``
 841
 842 :Description: The Keystone admin token (shared secret). In Ceph RadosGW
 843               authentication with the admin token has priority over
 844               authentication with the admin credentials
 845               (``rgw keystone admin user``, ``rgw keystone admin password``,
 846               ``rgw keystone admin tenant``, ``rgw keystone admin project``,
 847               ``rgw keystone admin domain``). The Keystone admin token
 848               has been deprecated, but can be used to integrate with
 849               older environments.  Prefer ``rgw keystone admin token path``
 850               to avoid exposing the token.
 851 :Type: String
 852 :Default: None
 853
 854 ``rgw keystone admin token path``
 855
 856 :Description: Path to a file containing the Keystone admin token
 857               (shared secret).  In Ceph RadosGW authentication with
 858               the admin token has priority over authentication with
 859               the admin credentials
 860               (``rgw keystone admin user``, ``rgw keystone admin password``,
 861               ``rgw keystone admin tenant``, ``rgw keystone admin project``,
 862               ``rgw keystone admin domain``).
 863               The Keystone admin token has been deprecated, but can be
 864               used to integrate with older environments.
 865 :Type: String
 866 :Default: None
 867
 868 ``rgw keystone admin tenant``
 869
 870 :Description: The name of OpenStack tenant with admin privilege (Service Tenant) when
 871               using OpenStack Identity API v2
 872 :Type: String
 873 :Default: None
 874
 875
 876 ``rgw keystone admin user``
 877
 878 :Description: The name of OpenStack user with admin privilege for Keystone
 879               authentication (Service User) when OpenStack Identity API v2
 880 :Type: String
 881 :Default: None
 882
 883
 884 ``rgw keystone admin password``
 885
 886 :Description: The password for OpenStack admin user when using OpenStack
 887               Identity API v2.  Prefer ``rgw keystone admin password path``
 888               to avoid exposing the token.
 889 :Type: String
 890 :Default: None
 891
 892 ``rgw keystone admin password path``
 893
 894 :Description: Path to a file containing the password for OpenStack
 895               admin user when using OpenStack Identity API v2.
 896 :Type: String
 897 :Default: None
 898
 899
 900 ``rgw keystone accepted roles``
 901
 902 :Description: The roles requires to serve requests.
 903 :Type: String
 904 :Default: ``Member, admin``
 905
 906
 907 ``rgw keystone token cache size``
 908
 909 :Description: The maximum number of entries in each Keystone token cache.
 910 :Type: Integer
 911 :Default: ``10000``
 912
 913
 914 ``rgw keystone revocation interval``
 915
 916 :Description: The number of seconds between token revocation checks.
 917 :Type: Integer
 918 :Default: ``15 * 60``
 919
 920
 921 ``rgw keystone verify ssl``
 922
 923 :Description: Verify SSL certificates while making token requests to keystone.
 924 :Type: Boolean
 925 :Default: ``true``
 926
 927
 928 Server-side encryption Settings
 929 ===============================
 930
 931 ``rgw crypt s3 kms backend``
 932
 933 :Description: Where the SSE-KMS encryption keys are stored. Supported KMS
 934               systems are OpenStack Barbican (``barbican``, the default) and
 935               HashiCorp Vault (``vault``).
 936 :Type: String
 937 :Default: None
 938
 939
 940 Barbican Settings
 941 =================
 942
 943 ``rgw barbican url``
 944
 945 :Description: The URL for the Barbican server.
 946 :Type: String
 947 :Default: None
 948
 949 ``rgw keystone barbican user``
 950
 951 :Description: The name of the OpenStack user with access to the `Barbican`_
 952               secrets used for `Encryption`_.
 953 :Type: String
 954 :Default: None
 955
 956 ``rgw keystone barbican password``
 957
 958 :Description: The password associated with the `Barbican`_ user.
 959 :Type: String
 960 :Default: None
 961
 962 ``rgw keystone barbican tenant``
 963
 964 :Description: The name of the OpenStack tenant associated with the `Barbican`_
 965               user when using OpenStack Identity API v2.
 966 :Type: String
 967 :Default: None
 968
 969 ``rgw keystone barbican project``
 970
 971 :Description: The name of the OpenStack project associated with the `Barbican`_
 972               user when using OpenStack Identity API v3.
 973 :Type: String
 974 :Default: None
 975
 976 ``rgw keystone barbican domain``
 977
 978 :Description: The name of the OpenStack domain associated with the `Barbican`_
 979               user when using OpenStack Identity API v3.
 980 :Type: String
 981 :Default: None
 982
 983
 984 HashiCorp Vault Settings
 985 ========================
 986
 987 ``rgw crypt vault auth``
 988
 989 :Description: Type of authentication method to be used. The only method
 990               currently supported is ``token``.
 991 :Type: String
 992 :Default: ``token``
 993
 994 ``rgw crypt vault token file``
 995
 996 :Description: If authentication method is ``token``, provide a path to the token
 997               file, which should be readable only by Rados Gateway.
 998 :Type: String
 999 :Default: None
1000
1001 ``rgw crypt vault addr``
1002
1003 :Description: Vault server base address, e.g. ``http://vaultserver:8200``.
1004 :Type: String
1005 :Default: None
1006
1007 ``rgw crypt vault prefix``
1008
1009 :Description: The Vault secret URL prefix, which can be used to restrict access
1010               to a particular subset of the secret space, e.g. ``/v1/secret/data``.
1011 :Type: String
1012 :Default: None
1013
1014 ``rgw crypt vault secret engine``
1015
1016 :Description: Vault Secret Engine to be used to retrieve encryption keys: choose
1017               between kv-v2, transit.
1018 :Type: String
1019 :Default: None
1020
1021 ``rgw crypt vault namespace``
1022
1023 :Description: If set, Vault Namespace provides tenant isolation for teams and individuals
1024               on the same Vault Enterprise instance, e.g. ``acme/tenant1``
1025 :Type: String
1026 :Default: None
1027
1028
1029 QoS settings
1030 ------------
1031
1032 .. versionadded:: Nautilus
1033
1034 The ``civetweb`` frontend has a threading model that uses a thread per
1035 connection and hence automatically throttled by ``rgw thread pool size``
1036 configurable when it comes to accepting connections. The ``beast`` frontend is
1037 not restricted by the thread pool size when it comes to accepting new
1038 connections, so a scheduler abstraction is introduced in Nautilus release which
1039 for supporting ways for scheduling requests in the future.
1040
1041 Currently the scheduler defaults to a throttler which throttles the active
1042 connections to a configured limit. QoS based on mClock is currently in an
1043 *experimental* phase and not recommended for production yet. Current
1044 implementation of *dmclock_client* op queue divides RGW Ops on admin, auth
1045 (swift auth, sts) metadata & data requests.
1046
1047
1048 ``rgw max concurrent requests``
1049
1050 :Description: Maximum number of concurrent HTTP requests that the beast frontend
1051               will process. Tuning this can help to limit memory usage under
1052               heavy load.
1053 :Type: Integer
1054 :Default: 1024
1055
1056
1057 ``rgw scheduler type``
1058
1059 :Description: The type of RGW Scheduler to use. Valid values are throttler,
1060               dmclock. Currently defaults to throttler which throttles beast
1061               frontend requests. dmclock is *experimental* and will need the
1062               experimental flag set
1063
1064
1065 The options below are to tune the experimental dmclock scheduler. For some
1066 further reading on dmclock, see :ref:`dmclock-qos`. `op_class` for the flags below is
1067 one of admin, auth, metadata or data.
1068
1069 ``rgw_dmclock_<op_class>_res``
1070
1071 :Description: The mclock reservation for `op_class` requests
1072 :Type: float
1073 :Default: 100.0
1074
1075 ``rgw_dmclock_<op_class>_wgt``
1076
1077 :Description: The mclock weight for `op_class` requests
1078 :Type: float
1079 :Default: 1.0
1080
1081 ``rgw_dmclock_<op_class>_lim``
1082
1083 :Description: The mclock limit for `op_class` requests
1084 :Type: float
1085 :Default: 0.0
1086
1087
1088
1089 .. _Architecture: ../../architecture#data-striping
1090 .. _Pool Configuration: ../../rados/configuration/pool-pg-config-ref/
1091 .. _Cluster Pools: ../../rados/operations/pools
1092 .. _Rados cluster handles: ../../rados/api/librados-intro/#step-2-configuring-a-cluster-handle
1093 .. _Barbican: ../barbican
1094 .. _Encryption: ../encryption
1095 .. _HTTP Frontends: ../frontends