Ceph RGW
Ceph exposes S3 through the RADOS Gateway, which listens on port 7480 by default. Credentials are not created in a web console but on the command line, and the output of a single radosgw-admin invocation gives you both halves of the pair.
Connection settings
- Endpoint
- http://{host}:7480
- Default region
- default
- Addressing
- Path-style
- Temporary credentials
- Not applicable
A filled-in example
Every value below is fabricated — they are shaped like real Ceph RGW credentials so you can recognise yours, and they authenticate nothing.
- Endpoint
- http://ceph-rgw.example.internal:7480
- Region
- default
- Access key
- CEPHEXAMPLEACCESSKEY
- Secret key
- EXAMPLEcephSecretKeyDoNotUse0123456789aa
- Addressing
- Path-style
radosgw-admin user create --uid=myuser --display-name="My User" prints a keys block containing access_key and secret_key. Those are the two values to copy.
Where each value comes from
Endpoint
Enter your RADOS Gateway URL — e.g., http://ceph-rgw.local:7480 (default port: 7480).
Credentials
Create S3 credentials with: radosgw-admin user create --uid=myuser --display-name="My User" — then use the access_key and secret_key from the output.
Notes
Ceph RGW supports both SigV2 and SigV4. The gateway can be behind a load balancer. Multi-tenant setups may require uid in the URL.
What usually goes wrong
Multi-tenant clusters need the tenant in the user id
On a cluster using tenants, the uid takes the form tenant$user and bucket names are scoped per tenant. A connection that authenticates but shows no buckets is usually looking at the wrong tenant.
Both signature versions are accepted
RADOS Gateway implements SigV2 and SigV4. This matters when a load balancer or proxy in front of it rewrites headers: signature failures there come from the intermediary, not from the gateway.
The port is often moved
7480 is the default, but deployments routinely put the gateway behind nginx or HAProxy on 80 and 443. Ask for the published endpoint rather than assuming the default.