# rgw Published articles for rgw. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## \[CVE\] \[URGENT\] Squid v19.2.6 and Tentacle v20.2.4 released DevFeed: [\[CVE\] \[URGENT\] Squid v19.2.6 and Tentacle v20.2.4 released]() Original publisher: [Read original article]() Author: Patrick Donnelly Published: 2026-08-19T00:00:00Z Content type: release Language: en Sources: [Ceph Blog]() Topics: [releases](), [Authentication](), [Linux](), [client](), [monitor]() Tags: [authentication](), [blog-post](), [cve](), [cves](), [en-article](), [en-blog-post](), [errors](), [linux](), [process](), [release](), [releases](), [rest](), [rgw](), [squid](), [tentacle](), [upgrade]() ### AI overview The Ceph project released Tentacle 20.2.4 and Squid 19.2.6 as hotfixes addressing four CVEs. The article urgently recommends upgrading and explains changes to CephX key types, daemon-key rotation, authentication controls, recovery procedures, and multisite RGW request signing. ### Source excerpt The Ceph project has released Tentacle 20.2.4 and Squid 19.2.6 hotfixes for four CVEs across several components. This is the sixth backport release in the Squid series. This is the fourth backport release in the Tentacle series. We strongly recommend that all Ceph operators upgrade to one of these releases as soon as possible. Release Date ¶ August 19, 2026 Critical Upgrade Steps ¶ The fix for CVE-2025-30156 introduces a new CephX key type, aes256k. This is the first time Ceph has introduced a new key type for CephX credentials. Therefore, a new procedure exists for upgrading and rotating Ceph daemon keys as part of this CVE. Before upgrading a Ceph cluster, the operator should familiarize themselves with the procedure to upgrade CephX keys. These steps are for package-based deployments of Ceph. In other sections, the document also includes new information about key rotation procedures, monitor authentication controls, and emergency recovery procedures. Deployments using cephadm will automate the process except for client keys. You may notice that Cephadm spends more time than normal on the upgrade after updating all daemon images. This is due to a new process rotating the OSD and MDS keys. Please be patient. There are plans to improve this in the future. Deployments using Rook will also automate rotation of some client keys with some exclusions. Look to the Rook project's announcement for more details. Client and kernel upgrades are recommended to support aes256k. Note that upstream Linux kernel client support began in kernel 7.0 and has been backported to CentOS Stream 9 and 10. Check with your distribution vendor for backported key support before rotating client keys used by the kernel. As part of upgrading a Ceph cluster, six new health warnings and errors will be generated. This is normal. As part of the process to upgrade/rotate entity keys, you will address the warnings and errors as you go. These are documented beginning here. The CephX documentation has bee ## v20.2.2 Tentacle released DevFeed: [v20.2.2 Tentacle released]() Original publisher: [Read original article]() Author: Yuri Weinstein, Patrick Donnelly Published: 2026-06-16T00:00:00Z Content type: release Language: en Sources: [Ceph Blog]() Topics: [bug](), [Vulnerabilities](), [Memory Leaks](), [Encryption](), [configuration](), [IO]() Tags: [2026](), [aio](), [blog-post](), [bug](), [ceph](), [configuration](), [en-article](), [en-blog-post](), [encryption](), [io](), [memory-leaks](), [rados](), [release](), [rgw](), [storage](), [tentacle](), [ui](), [update](), [vulnerabilities]() ### AI overview Ceph v20.2.2 Tentacle is a minor release that adds Rocky 10 package-install support and recommends updating. It fixes issues across MDS, OSD, RGW, RADOS libraries, watch/notify operations, asynchronous utilities, and the dashboard, including security vulnerabilities, memory leaks, encrypted-object lifecycle problems, and UI and configuration improvements. ### Source excerpt This is the second minor release in the Tentacle series. We recommend that all users update to this release. Release Date ¶ June 16, 2026 Notable Changes ¶ Rocky 10 package-based installs are now supported starting with v20.2.2. Please see the supported platforms for current and planned support in Ceph. MDS (Metadata Server) ¶ Segmentation fault fixed due to incorrect queueing of request retries. OSD (Object Storage Daemon) ¶ PGLog Missed List: Fixed a bug to ensure the correct version is attached to the missing list when ignoring log entries. Data Integrity Asserts: Added assertions to explicitly catch potential corruption in the OSD missing list. RGW (RADOS Gateway) ¶ Lifecycle Management: Fixed lifecycle transition issues affecting encrypted multipart objects. REST & Query Handling: RESTArgs::get_string() now properly URL-decodes incoming query parameters. RADOS / librados / neorados ¶ Linger Operations: Rewrote safety checks to eliminate use-after-free vulnerabilities and LingerOp memory leaks when an unwatch operation returns ENOTCONN. Replaced the flawed is_valid_watch() check with a safe linger_by_cookie() lookup which safely manages LingerOp references using intrusive_ptr. Ensured librados linger callbacks hold a persistent reference to LingerOp to protect against races with simultaneous linger_cancel() requests. Configured librados::IoCtxImpl::aio_unwatch() to asynchronously deliver ENOTCONN to AioCompletion instead of returning the error directly. Watch/Notify: Fixed neorados notification queue bounds enforcement so that an overflow marker is only appended on the first message exceeding capacity, rather than duplicating it on every subsequent message. Prevented double-cleanup triggers in watch/notify operations when incoming errors arrive after maybe_cleanup() runs. Fixed a bug where notify would lose original error values by ensuring it no longer attempts to decode empty responses. Enhanced io_context shutdown procedures to clear handlers and route cleanl ## Managing Multiple Lua Scripts with Ceph Object Storage DevFeed: [Managing Multiple Lua Scripts with Ceph Object Storage]() Original publisher: [Read original article]() Author: Kirby Chin Published: 2026-06-10T00:00:00Z Content type: article Language: en Sources: [Ceph Blog]() Topics: [Lua](), [Script](), [Scripting](), [Security](), [Command-line interface](), [cloud-infrastructure](), [ransomware]() Tags: [availability](), [blog](), [blog-post](), [ceph](), [cli](), [data](), [developer](), [en-article](), [en-blog-post](), [examples](), [feature](), [go](), [lua](), [management](), [new-feature](), [object-storage](), [operations](), [rados](), [ransomware](), [rgw](), [s3](), [scripting](), [security](), [storage]() ### AI overview This article introduces a Ceph RADOS Gateway feature for managing multiple Lua scripts within the same request context and tenant. It demonstrates scripts for enforcing bucket object locks to mitigate ransomware risks and for optimizing storage through object auto-tiering. ### Source excerpt Since the Pacific release, Lua scripting in Ceph's RADOS Gateway (RGW) has provided users the ability to interpolate a single script to upload operations per request context and tenant. This way of working might be completely fine for a storage deployment with limited scripting customizations. However, script management becomes increasingly difficult as more than one team wants to get involved in managing the Lua script within the same context and tenant. For this reason, we've released a new feature in RGW allowing you to manage more than one Lua script at a time. In this blog, we'll go over a couple of examples to walk you through how this feature can help your team to reduce runtime errors and lower developer friction when managing Lua scripts in RGW. To begin, we will create a script to enforce a bucket security control and then add another script to demonstrate the new feature. Script 1: Bucket security ¶ Let's suppose we are part of a security team and want to mitigate the risk of ransomware threats happening on our storage platform. One possible way to achieve this is to implement a Write Once, Read Many (WORM) strategy to add an object lock onto any newly created bucket. By using an object lock, we can add a constraint to write objects to disk only once, ensuring that an infected client cannot delete or override objects at a later time. To set our WORM strategy, we can create a Lua script in the prerequest context that aborts when a create_bucket operation is made without the write-once (object lock) requirement. objectlock.lua -- enforcing object lock on bucket creation if Request.RGWOp == "create_bucket" and Request.HTTP.Metadata["x-amz-bucket-object-lock-enabled"] ~= "true" then RGWDebugLog("object lock is missing on bucket: " .. Request.Bucket.Name) Request.Response.Message = "Bucket must have object lock enabled" return RGW_ABORT_REQUEST end You can create a new objectlock.lua file with the contents above and run the CLI commands below to upload the scr ## v20.2.1 Tentacle released DevFeed: [v20.2.1 Tentacle released]() Original publisher: [Read original article]() Author: Yuri Weinstein Published: 2026-04-06T00:00:00Z Content type: release Language: en Sources: [Ceph Blog]() Topics: [bug](), [configuration](), [monitor](), [Command-line interface](), [API](), [dashboards](), [JSON]() Tags: [2026](), [api](), [blog-post](), [bug](), [cli](), [en-article](), [en-blog-post](), [json](), [monitor](), [nvme](), [osd](), [peering](), [policy](), [recovery](), [reef](), [release](), [rgw](), [tentacle](), [ui](), [workflows]() ### AI overview Ceph v20.2.1, the first minor release in the Tentacle series, is recommended for all users. The release fixes storage, recovery, peering, validation, and dashboard issues; restricts unsafe fast EC configurations; improves NVMeoF Gateway failover; adds listener and subsystem CLI commands; introduces a transient exclusive RBD lock policy; and updates dashboard navigation and forms. ### Source excerpt This is the first minor release in the Tentacle series. We recommend that all users update to this release. Release Date ¶ April 06, 2026 Notable Changes ¶ OSD / BlueStore ¶ EC Recovery: Fixed a length calculation bug in erase_after_ro_offset() that caused empty shards to retain data, leading to shard_size >= tobj_size assertion failures when recovering small objects in EC pools. BlueFS Volume Selector: Updated the BlueFS volume selector to properly account for file size changes when recovering the WAL in envelope mode. BlueFS: Fixed a bug where stat() missed the actual file size update after indexing WAL envelope files. Monitor (mon) ¶ Fast EC Restrictions: Denied the ability to enable EC optimizations ("fast EC") for non-4K-aligned chunk sizes. Unaligned chunk sizes handled by fast EC perform poorly and suffer from bugs, so attempts to force this configuration are now rejected. Peering: Ensured ceph pg repeer proposes a correctly sized pg temp, as optimized EC cannot cope with mismatched sizes. NVMeoF Gateway: Added a new nvme-gw listeners command to display all existing listeners (including auto-listeners) inside a pool/group. NVMeoF Failover: Overhauled the NVMeoF Gateway fast-failover logic. Beacon timeouts are now evaluated within prepare_beacon to support shorter intervals, and the mechanism for detecting monitor slowness was improved. librbd & rbd-mirror ¶ RBD: Introduced a new RBD_LOCK_MODE_EXCLUSIVE_TRANSIENT policy for rbd_lock_acquire(). This is a low-level interface intended to allow a peer to grab exclusive lock manually for short periods of time with other peers pausing their activity and waiting for the lock to be released rather than instantly aborting I/O and returning an error. It's possible to switch from RBD_LOCK_MODE_EXCLUSIVE to RBD_LOCK_MODE_EXCLUSIVE_TRANSIENT policy and vice versa even if the lock is already held. Ceph Object Gateway (RGW) ¶ Multi-Part Operations: Fixed conditional validation handling in MultiWrite, Delete, and MultiDelete ## RGW Bucket Resharding Without Pausing DevFeed: [RGW Bucket Resharding Without Pausing]() Original publisher: [Read original article]() Author: Daniel Alexander Parkes, Anthony D'Atri Published: 2026-02-01T00:00:00Z Content type: article Language: en Sources: [Ceph Blog]() Topics: [systems](), [Scalability](), [Architecture & Design](), [cloud-infrastructure]() Tags: [2026](), [article](), [blog-post](), [ceph](), [concurrent](), [deep-dive](), [en-article](), [en-blog-post](), [io](), [operational](), [operations](), [performance](), [production](), [rgw](), [s3](), [scalability](), [scale](), [storage](), [systems]() ### AI overview The article explains how Ceph Tentacle introduces near-zero-impact RGW bucket resharding. Its two-phase architecture moves intensive work into a non-blocking background phase, avoiding the prolonged write unavailability and 504 errors seen in Ceph Squid and earlier versions. ### Source excerpt Introduction: The Foundation of Scalable Object Storage ¶ In the modern data landscape, object storage has evolved from a simple file repository into the foundational layer for AI/ML pipelines, data lakehouses, real-time analytics, and massive-scale archival systems. At the heart of this evolution is a deceptively simple question: How do you efficiently locate and access billions of objects stored in a single bucket? The answer lies in one of Ceph's most critical performance mechanisms: bucket index sharding. This architectural pattern divides a bucket's index into multiple parallel structures, enabling concurrent operations across thousands of objects while maintaining the consistency and reliability that enterprise workloads demand. But there's always been a catch. As workloads grow and evolve, buckets need to be resharded. Historically, when the buckets to be resharded had a vast number of objects, this operation came with a painful trade-off: blocking client writes from seconds to minutes, with a chance of causing application disruptions, 504 Gateway errors, and operational headaches. With Ceph Tentacle, we're eliminating this trade-off. The new near-zero impact bucket resharding architecture transforms what was once a maintenance window event into a seamless background operation that your applications will never notice. Note: As of 2026/02/05, the functionality described in this article is expected in an upcoming Tentacle update. Executive Summary ¶ The Challenge: In Ceph Squid, resharding a 20-million-object bucket blocked writes for 4+ minutes, returning 504 errors. Even larger buckets (500M objects) required 94 minutes of complete write unavailability. The Solution: Ceph Tentacle's two-phase architecture moves the heavy lifting to a non-blocking background phase, eliminating the impact on clients IO. The Results: (note: in this graphic 8.1 refers to Squid and 9.0 to Tentacle) In this deep dive, we'll explore: Why bucket sharding is essential for modern workl ## Mastering IAM in Ceph: Multi-Tenancy, Access Control, and Why ACLs Must Die DevFeed: [Mastering IAM in Ceph: Multi-Tenancy, Access Control, and Why ACLs Must Die]() Original publisher: [Read original article]() Author: Daniel Alexander Parkes, Anthony D'Atri Published: 2026-01-24T00:00:00Z Content type: article Language: en Sources: [Ceph Blog]() Topics: [IAM](), [Authorization](), [Security](), [Multi-tenancy](), [Amazon S3](), [Amazon Web Services](), [Architecture & Design]() Tags: [access-control](), [aws](), [blog-post](), [ceph](), [defense-in-depth](), [en-article](), [en-blog-post](), [iam](), [identity](), [multi-tenancy](), [operations](), [production](), [rgw](), [s3](), [security]() ### AI overview This article explains why ACLs in Ceph Object Gateway should be disabled in favor of centralized IAM policies. It discusses S3 permission failures, multi-tenant access problems, AWS's ACL-disabled defaults, and defense-in-depth measures such as Block Public Access and explicit denies for ACL operations. ### Source excerpt Introduction ¶ Introduction: When Security Theater Becomes a Real Disaster ¶ In March 2017, a misconfigured S3 bucket at Verizon exposed the personal information of 14 million customers. The root cause wasn't a sophisticated attack; it was a simple oversight in access permissions. The bucket was set to be publicly accessible due to S3 permission misconfiguration, and no one noticed because ACLs were managed separately from the company's centralized IAM policies. The security team had implemented careful, identity-based access controls, but a resource-level ACL silently bypassed them by granting access to "All Users." This scenario repeats constantly across the industry: ACLs creating invisible access paths that security teams don't know exist, buckets accidentally exposed to the public internet, and contractors uploading data that the bucket owner cannot reliably read or administer, while still consuming capacity. Between 2017 and 2019, major companies exposed hundreds of millions of records via misconfigured S3 permissions (ACLs and/or bucket policies): Verizon (2017): 14 million customers - An AWS S3 bucket configured for public access exposed names, addresses, account PINs Facebook (2019): 540 million records - Third-party apps stored user data in publicly accessible S3 buckets Instagram (2019): 49 million records - Marketing firm left influencer database unprotected in AWS S3 The AWS response was clear: since April 2023, all new S3 buckets default to "ACLs disabled" (BucketOwnerEnforced) and Block Public Access enabled. AWS strongly recommends disabling ACLs on existing buckets and migrating to a pure policy-based model with IAM Accounts architecture. If you're running the Ceph Object Gateway (RGW), you have access to the same IAM Accounts model introduced in Ceph Squid 19.2.0. This post explains why ACLs must be disabled immediately and how to implement modern, secure access control with IAM policies. Do This First (Quick Security Wins) Before reading further, ## Breaking the Static Key Habit: Modernizing Ceph RGW S3 Security with STS DevFeed: [Breaking the Static Key Habit: Modernizing Ceph RGW S3 Security with STS]() Original publisher: [Read original article]() Author: Daniel Alexander Parkes, Anthony D'Atri Published: 2025-12-18T00:00:00Z Content type: tutorial Language: en Sources: [Ceph Blog]() Topics: [Security](), [Amazon S3](), [Credential theft](), [configuration](), [GitHub](), [CI/CD](), [App]() Tags: [amazon-s3](), [app](), [aws](), [blog-post](), [ceph](), [ci-cd](), [code](), [configuration](), [credential-theft](), [en-article](), [en-blog-post](), [github](), [rgw](), [s3](), [security]() ### AI overview This tutorial explains how to replace long-lived S3 credentials in Ceph Object Gateway (RGW) applications with temporary credentials issued through Security Token Service (STS). It uses the Uber breach to illustrate how stolen static keys can enable persistent unauthorized access, and discusses credentials stored in configuration files, scripts, and CI/CD variables. ### Source excerpt Introduction: The USD 148 Million Lesson ¶ In late 2016, Uber learned that intruders had accessed a trove of personal data stored in an Amazon S3 bucket. The entry point was painfully mundane: attackers accessed Uber's source code on GitHub using stolen credentials, found an AWS credential, and used it to access Uber's data. That single, long-lived credential exposed data on roughly 57 million users and 600,000 drivers. The breach was bad; the duration risk was worse. Static access keys do not expire. Once leaked, they remain active until someone notices, locates every instance in use, and rotates them. That makes credential theft uniquely dangerous in cloud and S3-style storage, because an attacker can repeatedly return, automate access, and quietly expand their footprint. Uber ultimately agreed to a $148 million multistate settlement related to how the incident was handled and disclosed. The exact dollar figure is not the main lesson, though. The lesson is this: a single static key can turn a small mistake into a durable breach. If you are running the Ceph Object Gateway (RGW), you face the same dynamic: S3 credentials in an application configuration file config.yaml, embedded in scripts, or stored in CI/CD variables. Each one is a long-lived credential that, once copied, can be used from anywhere the S3 endpoint is reachable. This post shows you how to eliminate static credentials using Security Token Service (STS) with temporary credentials that expire automatically. By the end, you'll understand how to implement the same security model that prevented these breaches from being even worse, and how to adapt it for Ceph RGW. The Static Credential Problem ¶ Let's take a look at some examples of how most applications access S3 storage today: # app-config.yaml (application config file) s3: endpoint: https://s3.example.com access_key: AKIA1234567890ABCDEF secret_key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY bucket: production-data Or with the credentials embedded direc ## Migrating cPouta Object Storage to the Allas Ceph Service DevFeed: [Migrating cPouta Object Storage to the Allas Ceph Service]() Original publisher: [Read original article]() Author: Kalle Happonen (noreply@blogger.com) Published: 2019-12-27T11:23:00Z Content type: article Language: en Sources: [CSC - IT Center For Science - Cloud Team]() Topics: [ceph](), [migration](), [Data Management](), [data](), [cloud-infrastructure]() Tags: [ceph](), [data-management](), [migration](), [object-storage](), [openstack](), [radosgw](), [rgw](), [storage]() ### AI overview This article describes CSC's migration from the cPouta object storage service to Allas, a standalone Ceph-based object storage service. The plan aimed to move user data without requiring user changes or breaking existing data links, using a new Ceph cluster and new data pools. ### Source excerpt We have released our new Allas object storage service. We firmly believe it will play a growing role for data management, at CSC and for the whole academic field in Finland. Alas, the road to Allas was not completely without pain. CSC also hosts the cPouta IaaS service. It provided its own object storage service. Our goal with Allas was to build on this, and transform the object storage portion to a standalone service. This would raise the profile of the service, and make it easier to scale, both human resource wise and where it comes to the platform size. So, in brief, our aim was: Replace cPouta object storage with Allas Make sure all the user data from cPouta object storage moves over. Make sure cPouta object storage users don't have to do any changes. Don't break any existing links to data in cPouta object storage. How did we intend to do this, you may ask? Migration plan What were our options? We had a large bunch of new hardware, and a high level plan. For those of you who know Ceph, you might have already thought of how you'd do this. Add more hardware to the same storage pool, slap on an additional domain name to access the data, and call it a day. Create additional data pools, make sure radosgw uses old and new pools for data, slap on an additional domain name, and call it a day. Create a new Ceph cluster with new pools, migrate the data over, add the old and new domain names, and call it a day. Number 3. is definitely the most work, but we went with that. The main reason for that was that if we want to achieve all the benefits of separating Allas into its own service, we actually need to be a bit separate. For example, the old object storage pools were in the same cluster as the block storage pools used by our OpenStack virtual machines. This not only locked us to the current version of Ceph running there, but created a lot on interdependencies between the services. To make it easier, I'll use the terms rgw-old (cPouta object storage) and rgw-new (Allas) t ## Admin Stories: Implement Object Storage in CSC's cPouta DevFeed: [Admin Stories: Implement Object Storage in CSC's cPouta]() Original publisher: [Read original article]() Author: Unknown (noreply@blogger.com) Published: 2018-02-12T12:58:00Z Content type: article Language: en Sources: [CSC - IT Center For Science - Cloud Team]() Topics: [ceph](), [Amazon S3](), [Cloud](), [API]() Tags: [backend](), [ceph](), [cpouta](), [infrastructure](), [object](), [object-storage](), [openstack](), [rados](), [radosgw](), [rgw](), [s3](), [server](), [servers](), [storage](), [volume]() ### AI overview This article explains the decisions behind implementing object storage in CSC's cPouta cloud. It describes using Ceph RADOS Gateway with existing Ceph clusters and clarifies the relationship between S3 buckets, Swift containers, accounts, and OpenStack project IDs. ### Source excerpt In our previous user survey we found out that you were interested in "OpenStack admin stories". This will be our first attempt in doing that. User guide: https://research.csc.fi/pouta-user-guide While implementing object storage we made a few decisions. This blog post is about highlighting the decisions and their backing thought process. Some background information: cPouta uses OpenStack as the underlying cloud middleware, and Ceph for storing volumes and images. And going forward, objects, too. Terminology RADOS Gateway/RadosGW/RGW/Ceph RGW/Ceph radosgw/radosgw. We mean the same thing. It's a piece of software which exposes an API for storing and retrieving objects. Ceph - the storage system which RadosGW daemons access as a client. Buckets in S3 and Containers in Swift are synonymous. The Ceph radosgw-admin tool also operates on buckets. The latter are mostly the same, but can contain a bit more information i.e. OpenStack project ID. If we write about buckets, the reader can presume we are referring to S3 buckets and Swift containers unless otherwise noted. Account is something that RGW binds usage data into. In some of the radosgw-admin CLI calls, accounts are referred to as users or UIDs. These users and/or accounts get a mapping to OpenStack project IDs in our configuration. So be it account/user/project, we are always talking about the same thing. - Why Ceph RadosGW The other option we briefly looked at for an Object Storage server was the OpenStack Swift server. Yes, there is an API called Swift and a piece of sofware called Swift which serves the Swift API. Not to mention the programming language Swift, the ISO standard SWIFT or the Scottish potato variant Swift. In the end we used none of these for backend because we prefer to reuse existing infrastructure. We already have Ceph clusters used for Virtual Machine image and block (volume) storage in our clouds. Installing some Ceph RadosGW servers and pointing those to an existing Ceph cluster utilizes a lot o