Chapter 2. Ceph Dashboard installation and access

Procedure

1. Enter the following URL in a web browser:

   Syntax

   https://HOST_NAME:PORT

   Replace:

   • HOST_NAME with the fully qualified domain name (FQDN) of the active manager host.

   • PORT with port 8443

     Example

     https://host01:8443

     You can also get the URL of the dashboard by running the following command in the Cephadm shell:

     Example

     [ceph: root@host01 /]# ceph mgr services

     This command will show you all endpoints that are currently configured. Look for the dashboard key to obtain the URL for accessing the dashboard.

2. On the login page, enter the username admin and the default password provided during bootstrapping.
3. You have to change the password the first time you log in to the Red Hat Ceph Storage dashboard.

4. After logging in, the dashboard default landing page is displayed, which provides details, a high-level overview of status, performance, inventory, and capacity metrics of the Red Hat Ceph Storage cluster.

   Figure 2.1. Ceph dashboard landing page

   
5. Click the menu icon ( ) on the dashboard landing page to collapse or display the options in the vertical menu.

Procedure

1. Copy the admin key from the bootstrapped host to other hosts:

   Syntax

   ssh-copy-id -f -i /etc/ceph/ceph.pub root@HOST_NAME

   Example

   [ceph: root@host01 /]# ssh-copy-id -f -i /etc/ceph/ceph.pub root@host02
   [ceph: root@host01 /]# ssh-copy-id -f -i /etc/ceph/ceph.pub root@host03

2. Log in to the dashboard with the default credentials provided during bootstrap.
3. Change the password and log in to the dashboard with the new password .

4. On the landing page, click Expand Cluster.

   Figure 2.2. Expand cluster

   

5. Add hosts:

   1. In the Add Hosts window, click +Add.

   2. Provide the hostname. This is same as the hostname that was provided while copying the key from the bootstrapped host.

      Note

      You can use the tool tip in the Add Hosts dialog box for more details.

   3. Optional: Provide the respective IP address of the host.
   4. Optional: Select the labels for the hosts on which the services are going to be created.
   5. Click Add Host.
   6. Follow the above steps for all the hosts in the storage cluster.
6. In the Add Hosts window, click Next.

7. Create OSDs:

   1. In the Create OSDs window, for Primary devices, Click +Add.
   2. In the Primary Devices window, filter for the device and select the device.
   3. Click Add.
   4. Optional: In the Create OSDs window, if you have any shared devices such as WAL or DB devices, then add the devices.
   5. Optional: Click on the check-box Encryption to encrypt the features.
   6. In the Create OSDs window, click Next.

8. Create services:

   1. In the Create Services window, click +Create.

   2. In the Create Service dialog box,

      1. Select the type of the service from the drop-down.
      2. Provide the service ID, a unique name of the service.
      3. Provide the placement by hosts or label.
      4. Select the hosts.
      5. Provide the number of daemons or services that need to be deployed.
   3. Click Create Service.
9. In the Create Service window, Click Next.

10. Review the Cluster Resources, Hosts by Services, Host Details. If you want to edit any parameter, click Back and follow the above steps.

    Figure 2.3. Review cluster

    
11. Click Expand Cluster.
12. You get a notification that the cluster expansion was successful.
13. The cluster health changes to HEALTH_OK status on the dashboard.

Verification

1. Log in to the cephadm shell:

   Example

   [root@host01 ~]# cephadm shell

2. Run the ceph -s command.

   Example

   [ceph: root@host01 /]# ceph -s

   The health of the cluster is HEALTH_OK.

1. Status
2. Capacity
3. Performance

Procedure

1. Log in to the dashboard:

   https://HOST_NAME:8443

2. Click the Dashboard Settings icon and then click User management.

   Figure 2.6. User management

   
3. To change the password of admin, click it’s row.
4. From the Edit drop-down menu, select Edit.

5. In the Edit User window, enter the new password, and change the other parameters, and then Click Edit User.

   Figure 2.7. Edit user management

   

   You will be logged out and redirected to the log-in screen. A notification appears confirming the password change.

Procedure

1. Log into the Cephadm shell:

   Example

   [root@host01 ~]# cephadm shell

2. Create the dashboard_password.yml file:

   Example

   [ceph: root@host01 /]# touch dashboard_password.yml

3. Edit the file and add the new dashboard password:

   Example

   [ceph: root@host01 /]# vi dashboard_password.yml

4. Reset the dashboard password:

   Syntax

   ceph dashboard ac-user-set-password DASHBOARD_USERNAME -i PASSWORD_FILE

   Example

   [ceph: root@host01 /]# ceph dashboard ac-user-set-password admin -i dashboard_password.yml
   {"username": "admin", "password": "$2b$12$i5RmvN1PolR61Fay0mPgt.GDpcga1QpYsaHUbJfoqaHd1rfFFx7XS", "roles": ["administrator"], "name": null, "email": null, "lastUpdate": , "enabled": true, "pwdExpirationDate": null, "pwdUpdateRequired": false}

Procedure

1. As a root user, create a grafana.yml file and provide the following details:

   Syntax

   service_type: grafana
   spec:
     initial_admin_password: PASSWORD

   Example

   service_type: grafana
   spec:
     initial_admin_password: mypassword

2. Mount the grafana.yml file under a directory in the container:

   Example

   [root@host01 ~]# cephadm shell --mount grafana.yml:/var/lib/ceph/grafana.yml

   Note

   Every time you exit the shell, you have to mount the file in the container before deploying the daemon.

3. Optional: Check if the dashboard Ceph Manager module is enabled:

   Example

   [ceph: root@host01 /]# ceph mgr module ls

4. Optional: Enable the dashboard Ceph Manager module:

   Example

   [ceph: root@host01 /]# ceph mgr module enable dashboard

5. Apply the specification using the orch command:

   Syntax

   ceph orch apply -i FILE_NAME.yml

   Example

   [ceph: root@host01 /]# ceph orch apply -i /var/lib/ceph/grafana.yml

6. Redeploy grafana service:

   Example

   [ceph: root@host01 /]# ceph orch redeploy grafana

   This creates an admin user called admin with the given password and the user can log in to the Grafana URL with these credentials.

Procedure

1. Log into the Cephadm shell:

   Example

   [root@host01 ~]# cephadm shell

2. Check the Ceph Manager services:

   Example

   [ceph: root@host01 /]# ceph mgr services
   
   {
       "prometheus": "http://10.8.0.101:9283/"
   }

   You can see that the Dashboard URL is not configured.

3. Enable the dashboard module:

   Example

   [ceph: root@host01 /]# ceph mgr module enable dashboard

4. Create the self-signed certificate for the dashboard access:

   Example

   [ceph: root@host01 /]# ceph dashboard create-self-signed-cert

   Note

   You can disable the certificate verification to avoid certification errors.

5. Check the Ceph Manager services:

   Example

   [ceph: root@host01 /]# ceph mgr services
   
   {
       "dashboard": "https://10.8.0.101:8443/",
       "prometheus": "http://10.8.0.101:9283/"
   }

6. Create the admin user and password to access the Red Hat Ceph Storage dashboard:

   Syntax

   echo -n "PASSWORD" > PASSWORD_FILE
   ceph dashboard ac-user-create admin -i PASSWORD_FILE administrator

   Example

   [ceph: root@host01 /]# echo -n "p@ssw0rd" > password.txt
   [ceph: root@host01 /]# ceph dashboard ac-user-create admin -i password.txt administrator

7. Enable the monitoring stack. See the Enabling monitoring stack section in the Red Hat Ceph Storage Dashboard Guide for details.

Procedure

1. Download the Red Hat Single Sign-On 7.4.0 Server on the system where Red Hat Ceph Storage is installed.

2. Unzip the folder:

   [root@host01 ~]# unzip rhsso-7.4.0.zip

3. Navigate to the standalone/configuration directory and open the standalone.xml for editing:

   [root@host01 ~]# cd standalone/configuration
   [root@host01 configuration]# vi standalone.xml

4. Replace all instances of localhost and two instances of 127.0.0.1 with the IP address of the machine where Red Hat SSO is installed.

5. Optional: For Red Hat Enterprise Linux 8, users might get Certificate Authority (CA) issues. Import the custom certificates from CA and move them into the keystore with the exact java version.

   Example

   [root@host01 ~]# keytool -import -noprompt -trustcacerts -alias ca -file ../ca.cer -keystore /etc/java/java-1.8.0-openjdk/java-1.8.0-openjdk-1.8.0.272.b10-3.el8_3.x86_64/lib/security/cacert

6. To start the server from the bin directory of rh-sso-7.4 folder, run the standalone boot script:

   [root@host01 bin]# ./standalone.sh

7. Create the admin account in https: IP_ADDRESS :8080/auth with a username and password:

   Note

   You have to create an admin account only the first time that you log into the console

8. Log into the admin console with the credentials created.

Procedure

1. To create a realm, click the Master drop-down menu. In this realm, you can provide access to users and applications.

2. In the Add Realm window, enter a case-sensitive realm name and set the parameter Enabled to ON and click Create:

   

3. In the Realm Settings tab, set the following parameters and click Save:

   1. Enabled - ON
   2. User-Managed Access - ON

   3. Make a note of the link address of SAML 2.0 Identity Provider Metadata to paste in Client Settings.

      

4. In the Clients tab, click Create:

   

5. In the Add Client window, set the following parameters and click Save:

   1. Client ID - BASE_URL:8443/auth/saml2/metadata

      Example

      https://example.ceph.redhat.com:8443/auth/saml2/metadata

   2. Client Protocol - saml

6. In the Client window, under Settings tab, set the following parameters:

   Table 2.2. Client Settings tab

   Name of the parameter	Syntax	Example
   Client ID	BASE_URL:8443/auth/saml2/metadata	https://example.ceph.redhat.com:8443/auth/saml2/metadata
   Enabled	ON	ON
   Client Protocol	saml	saml
   Include AuthnStatement	ON	ON
   Sign Documents	ON	ON
   Signature Algorithm	RSA_SHA1	RSA_SHA1
   SAML Signature Key Name	KEY_ID	KEY_ID
   Valid Redirect URLs	BASE_URL:8443/*	https://example.ceph.redhat.com:8443/*
   Base URL	BASE_URL:8443	https://example.ceph.redhat.com:8443/
   Master SAML Processing URL	https://localhost:8080/auth/realms/REALM_NAME/protocol/saml/descriptor	https://localhost:8080/auth/realms/Ceph_LDAP/protocol/saml/descriptor

   Note

   Paste the link of SAML 2.0 Identity Provider Metadata from Realm Settings tab.

   Under Fine Grain SAML Endpoint Configuration, set the following parameters and click Save:

   Table 2.3. Fine Grain SAML configuration

   Name of the parameter	Syntax	Example
   Assertion Consumer Service POST Binding URL	BASE_URL:8443/#/dashboard	https://example.ceph.redhat.com:8443/#/dashboard
   Assertion Consumer Service Redirect Binding URL	BASE_URL:8443/#/dashboard	https://example.ceph.redhat.com:8443/#/dashboard
   Logout Service Redirect Binding URL	BASE_URL:8443/	https://example.ceph.redhat.com:8443/

7. In the Clients window, Mappers tab, set the following parameters and click Save:

   Table 2.4. Client Mappers tab

   Name of the parameter	Value
   Protocol	saml
   Name	username
   Mapper Property	User Property
   Property	username
   SAML Attribute name	username

8. In the Clients Scope tab, select role_list:

   1. In Mappers tab, select role list, set the Single Role Attribute to ON.

9. Select User_Federation tab:

   1. In User Federation window, select ldap from the drop-down menu:

   2. In User_Federation window, Settings tab, set the following parameters and click Save:

      Table 2.5. User Federation Settings tab

      Name of the parameter	Value
      Console Display Name	rh-ldap
      Import Users	ON
      Edit_Mode	READ_ONLY
      Username LDAP attribute	username
      RDN LDAP attribute	username
      UUID LDAP attribute	nsuniqueid
      User Object Classes	inetOrgPerson, organizationalPerson, rhatPerson
      Connection URL	Example: ldap://ldap.corp.redhat.com Click Test Connection. You will get a notification that the LDAP connection is successful.
      Users DN	ou=users, dc=example, dc=com
      Bind Type	simple

      Click Test authentication. You will get a notification that the LDAP authentication is successful.

   3. In Mappers tab, select first name row and edit the following parameter and Click Save:

      • LDAP Attribute - givenName

   4. In User_Federation tab, Settings tab, Click Synchronize all users:

      

      You will get a notification that the sync of users is finished successfully.

10. In the Users tab, search for the user added to the dashboard and click the Search icon:

    

11. To view the user , click the specific row. You should see the federation link as the name provided for the User Federation.

    
    Important

    Do not add users manually as the users will not be synchronized by LDAP. If added manually, delete the user by clicking Delete.

Procedure

1. To configure SSO on Ceph Dashboard, run the following command:

   Syntax

   cephadm shell CEPH_MGR_HOST ceph dashboard sso setup saml2 CEPH_DASHBOARD_BASE_URL IDP_METADATA IDP_USERNAME_ATTRIBUTE IDP_ENTITY_ID SP_X_509_CERT SP_PRIVATE_KEY

   Example

   [root@host01 ~]# cephadm shell host01 ceph dashboard sso setup saml2 https://dashboard_hostname.ceph.redhat.com:8443 idp-metadata.xml username https://10.70.59.125:8080/auth/realms/realm_name /home/certificate.txt /home/private-key.txt

   Replace

   • CEPH_MGR_HOST with Ceph mgr host. For example, host01
   • CEPH_DASHBOARD_BASE_URL with the base URL where Ceph Dashboard is accessible.
   • IDP_METADATA with the URL to remote or local path or content of the IdP metadata XML. The supported URL types are http, https, and file.
   • Optional: IDP_USERNAME_ATTRIBUTE with the attribute used to get the username from the authentication response. Defaults to uid.
   • Optional: IDP_ENTITY_ID with the IdP entity ID when more than one entity ID exists on the IdP metadata.
   • Optional: SP_X_509_CERT with the file path of the certificate used by Ceph Dashboard for signing and encryption.
   • Optional: SP_PRIVATE_KEY with the file path of the private key used by Ceph Dashboard for signing and encryption.

2. Verify the current SAML 2.0 configuration:

   Syntax

   cephadm shell CEPH_MGR_HOST ceph dashboard sso show saml2

   Example

   [root@host01 ~]#  cephadm shell host01 ceph dashboard sso show saml2

3. To enable SSO, run the following command:

   Syntax

   cephadm shell CEPH_MGR_HOST ceph dashboard sso enable saml2
   SSO is "enabled" with "SAML2" protocol.

   Example

   [root@host01 ~]#  cephadm shell host01 ceph dashboard sso enable saml2

4. Open your dashboard URL.

   Example

   https://dashboard_hostname.ceph.redhat.com:8443

5. On the SSO page, enter the login credentials. SSO redirects to the dashboard web interface.

Procedure

1. To view status of SSO, run the following command:

   Syntax

   cephadm shell CEPH_MGR_HOST ceph dashboard sso status

   Example

   [root@host01 ~]#  cephadm shell host01 ceph dashboard sso status
   SSO is "enabled" with "SAML2" protocol.

2. To disable SSO, run the following command:

   Syntax

   cephadm shell CEPH_MGR_HOST ceph dashboard sso disable
   SSO is "disabled".

   Example

   [root@host01 ~]#  cephadm shell host01 ceph dashboard sso disable