新版使用cephadm安装ceph octopus

admin

Ceph集群基础库安装
步骤：
2-1. 安装配置其它基础包，pip、deltarpm、ceph-common  
2-2. 防火墙规则添加
# x7 n4 c# [) T
2-1 安装配置其它基础包，pip、deltarpm、ceph-common

1. sed -i 's/^SELINUX\=.*/SELINUX=disabled/g' /etc/selinux/config2.  yum install -y python3 epel-release ceph-mgr-dashboard ceph-common    pip3 install --upgrade pip3. yum install -y snappy leveldb gdisk python3-ceph-argparse python3-flask gperftools-libs4. yum install -y ceph

2-2 防火墙规则添加
- R& k9 @1 p$ s
5 i: x6 d, y- ]bash> firewall-cmd --zone=public --add-service=ceph-mon --permanentbash> firewall-cmd --zone=public --add-service=ceph --permanentbash> firewall-cmd --zone=public --add-service=ntp --permanentbash> firewall-cmd --reload
附：ceph相关使端口列表
" o, {& |( k; y" }0 t1 k: }　　CephMonitor(ceph-mon)：3300、6789(TCP)
' G4 x* U  E3 C: T: U' e　　CephManager(ceph-mgr)：6800、6801、以及一个自定义Web端口(TCP)
　　CephOSD(ceph-osd): 6800->7300(TCP)
以上为止，则整个ceph集群的基础依赖环境都安装好。

Cephadm使用podman容器和systemd安装和管理Ceph分布式集群，并与CLI和仪表板GUI紧密集成。
•cephadm仅支持octopus  v15.2.0或者更高版本。
* M' X; O: M7 ]/ U  f& G& ~•cephadm与新的业务流程API完全集成，并完全支持新的CLI和仪表板功能来管理集群部署。
•cephadm需要容器支持（podman或docker）和Python 3。
•时间同步

& P/ Z4 Y. d  _( Y这里使用的centos8来安装的ceph
+ J; W: e, ]& Z/ N% ?2 O
配置hosts解析cat >> /etc/hosts <<EOF192.168.8.65 node1192.168.8.66 node2192.168.8.67 node3EOF关闭selinux
setenforce 0 && sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config设置主机名hostnamectl set-hostname node1安装podmandnf install -y podman
安装cephadm
, q! b' D1 c' F6 D# v8 @cephadm命令可以
9 H* ^( K) l7 P& U/ H1.引导新集群
4 q" d% ^; m% ?6 o3 R( I$ C2 I2.使用有效的Ceph CLI启动容器化的Shell
& R- C& o2 g3 ~' p- v- z/ Z2 G; U3.帮助调试容器化的Ceph守护进程。
& B; r, v2 n$ u$ z3 A
以下操作只在一台节点执行就可以
1 j. F4 C# j" b1 t4 [curl --silent --remote-name --location https://github.com/ceph/ceph/raw/octopus/src/cephadm/cephadm
4 t* k0 M) V1 ]& Y" c. u1 s2 Vchmod +x cephadm
. m0 \9 F3 N+ C' h( D安装cephadmn
) z# w4 ?; e+ {5 M* [% `4 P./cephadm add-repo --release octopus
/ O2 S5 q( ~9 B4 h./cephadm install
要引导群集，需要先创建一个目录：/etc/ceph
mkdir -p /etc/ceph
然后运行该命令：ceph bootstrap
- b6 b( w9 p) m6 Z9 Icephadm bootstrap --mon-ip 192.168.8.65


此命令将会进行以下操作：
为本地主机上的新群集创建monitor和manager守护程序。
为 Ceph 群集生成新的 SSH 密钥，并将其添加到root用户的文件/root/.ssh/authorized_keys
将与新群集通信所需的最小配置文件保存到 /etc/ceph/ceph.conf
' _5 o, v  m" B: A将client.admin管理（特权！）密钥的副本写入/etc/ceph/ceph.client.admin.keyring
将公钥的副本写入/etc/ceph/ceph.pub
安装完成后会有一个dashboard界面
. {$ Z3 o. x: N! n" y9 j7 N( U
6 L3 h  ~9 X; q. R1 `. C8 F
执行完成后我们可以查看ceph.conf已经写入了
. k7 {/ g: H4 s% K7 ^
" E  t+ G) `7 X( {: ]
启用 CEPH CLI
  Q9 Y! B: v2 v3 }! H4 Ncephadm shell命令在安装了所有Ceph包的容器中启动bash shell。默认情况下，如果在主机上的/etc/ceph中找到配置和keyring文件，则会将它们传递到容器环境中，以便shell完全正常工作。
3 e  b& m& c4 |: N- o1 Bcephadm shell

; l/ M7 q6 d! m( r可以在节点上安装包含所有 ceph 命令的包，包括 、（用于安装 CephFS 文件系统）等
cephadm add-repo --release octopus
cephadm install ceph-common

' \$ {7 R& i8 B+ `7 Z7 n安装过程很慢，可以手动将源改为本地镜像：
; ?* p. K) }) r, @4 D
添加主机到集群
将公钥添加到新主机
ssh-copy-id -f -i /etc/ceph/ceph.pub node2
ssh-copy-id -f -i /etc/ceph/ceph.pub node3
2 s" Y( _7 |7 a* m+ w$ {; u; D5 _: n

告诉Ceph，新节点是集群的一部分
[root@localhost ~]# ceph orch host add node2
8 q6 V: e4 `! F3 a0 @Added host 'node2'
3 ?& J5 U7 p5 L3 v4 q* m3 G[root@localhost ~]# ceph orch host add node3
Added host 'node3'

# ?# I) p4 g: g. \  a- X  b添加主机会自动扩展mon和mgr节点



部署其他监视器（可选）
典型的 Ceph 群集具有三个或五个分布在不同主机的mon守护程序。如果群集中有五个或更多节点，建议部署五个mon。
; u0 Q  T; m* j1 c' p当Ceph知道mon应该使用什么IP子网时，它可以随着群集的增长（或收缩）自动部署和缩放mon。默认情况下，Ceph假定其他mon使用与第一个mon的IP相同的子网。
在单个子网的情况下，如果向集群中添加主机，默认最多只会添加5个mon 如果有特定的IP子网给mon使用，可以使用CIDR格式配置该子网：

1 j0 `) K8 N& H! h/ @/ a0 c8 k: Sceph config set mon public_network 10.1.2.0/24
cephadm只会在配置了特定子网IP的主机上部署mon守护程序 如果要调整特定子网mon的默认数量，可以执行以下命令：
ceph orch apply mon *<number-of-monitors>*
) H5 L. h0 j6 v6 t3 j如果要在一组特定的主机上部署mon，可以执行以下命令：
ceph orch apply mon *<host1,host2,host3,...>*
如果要查看当前主机和标签，可以执行以下命令：

( L* ^3 w+ x& r- O[root@node1 ~]# ceph orch host ls
% v5 j( t" o0 R6 i5 z& X1 y- NHOST   ADDR   LABELS  STATUS  
8 W' d: |# n0 Q5 ~node1  node1                  
1 c, i, `- V. A8 N/ J- z5 ?- hnode2  node2                  
. d7 U' a% ]$ ?" E) lnode3  node3  
9 F4 p; [6 m8 q  U如果要禁用自动mon部署，执行以下命令：
ceph orch apply mon --unmanaged
要在不同网络中添加mon执行以下命令：
ceph orch apply mon --unmanaged
2 b( J2 u# C# Uceph orch daemon add mon node2:192.168.8.66
ceph orch daemon add mon node2:192.168.17.0/24

/ l# \5 n% ]3 d" z7 }) k如果要添加mon到多个主机，也可以用以下命令：
ceph orch apply mon "host1,host2,host3"

! W- _4 O1 ~% o部署OSD
/ H7 W/ M# F$ r1 g% K. [! T8 p可以用以下命令显示集群中的存储设备清单
ceph orch device ls

如果满足以下所有_条件_，则存储设备被视为可用：
设备必须没有分区。
设备不得具有任何 LVM 状态。
8 O9 t; g$ I# u1 I% M' z不得安装设备。
设备不能包含文件系统。
% f9 ^/ L- L0 a" F% ?设备不得包含 Ceph BlueStore OSD。
+ e6 [( q- O% \% D, N设备必须大于 5 GB。
Ceph 拒绝在不可用的设备上预配 OSD。为保证能成功添加osd，我刚才在每个node上新加了一块磁盘 创建新 OSD 的方法有几种方法：
% C% ?+ ]) Q! s在未使用的设备上自动创建osd
! R9 Z3 `  i+ s7 ?, s[root@node1 ~]# ceph orch apply osd --all-available-devices
Scheduled osd.all-available-devices update...
: Q5 w- r8 [( _. D  k4 Q, m可以看到已经在三块磁盘上创建了osd
' l3 }1 n  X2 ^
$ c% |# j8 x8 t% _$ `; l从特定主机上的特定设备创建 OSD
; j$ r2 o0 F) Z* T5 Hceph orch daemon add osd host1:/dev/sdb
部署MDS
使用 CephFS 文件系统需要一个或多个 MDS 守护程序。如果使用新的ceph fs卷接口来创建新文件系统，则会自动创建这些文件 部署元数据服务器：
+ j8 _0 E6 r/ E6 W* [ceph orch apply mds *<fs-name>* --placement="*<num-daemons>* [*<host1>* ...]"
7 ]; H( |: \! W$ rCephFS 需要两个 Pools，cephfs-data 和 cephfs-metadata,分别存储文件数据和文件元数据
[root@node1 ~]# ceph osd pool create cephfs_data 64 64
[root@node1 ~]# ceph osd pool create cephfs_metadata 64 64
创建一个 CephFS, 名字为 cephfs
6 a( d* [6 }/ f[root@node1 ~]# ceph fs new cephfs cephfs_metadata cephfs_data
[root@node1 ~]# ceph orch apply mds cephfs --placement="3 node1 node2 node3"
Scheduled mds.cephfs update...
  ?) G/ F1 E5 B6 i6 |
* l. C! a+ d- s0 o% n" X验证至少有一个MDS已经进入active状态，默认情况下，ceph只支持一个活跃的MDS，其他的作为备用MDS
$ p2 x$ {' R5 D, L( }) Sceph fs status cephfs

" N$ @7 P* I' t, e- w% O% e部署RGW
! p/ d8 p) ~# q* `Cephadm将radosgw部署为管理特定领域和区域的守护程序的集合，RGW是Ceph对象存储网关服务RADOS Gateway的简称，是一套基于LIBRADOS接口封装而实现的FastCGI服务，对外提供RESTful风格的对象存储数据访问和管理接口。

使用cephadm时，radosgw守护程序是通过mon配置数据库而不是通过ceph.conf或命令行配置的。如果该配置尚未就绪，则radosgw守护进程将使用默认设置启动（默认绑定到端口80）。要在node1、node2和node3上部署3个服务于myorg领域和us-east-1区域的rgw守护进程，在部署rgw守护进程之前，如果它们不存在，则自动创建提供的域和区域：
7 |# d4 p3 X! L; d) M% R5 H& qceph orch apply rgw myorg cn-east-1 --placement="3 node1 node2 node3"
或者可以使用radosgw-admin命令手动创建区域、区域组和区域：
radosgw-admin realm create --rgw-realm=myorg --default
2 S3 Y: H5 ^& b7 A, ~. J% v7 Tradosgw-admin zonegroup create --rgw-zonegroup=default --master --default
radosgw-admin zone create --rgw-zonegroup=default --rgw-zone=cn-east-1 --master --default
radosgw-admin period update --rgw-realm=myorg --c
% r- e6 ^9 w$ i5 a可以看到RGW已经创建完成
' X; z8 e0 K7 y* z4 h5 {: p
. w- b& i5 M: G, H, g3 h9 P: }并且cephadm会自动安装Prometheus和grafana等组件，grafana默认用户密码为admin/admin，并且已经导入了Prometheus监控ceph的仪表盘
5 L; P: O1 x5 x) l8 x  a
5 n& {) ^+ ^. b' d
/ P* I5 u, H2 _, T! Z" ^. m
- Z) |" c/ A2 s7 M. n

admin

安装ceph源
% _. i, r) B3 T8 o5 Y! @! t
- _. m3 e2 `/ c% M) X: I1 c& |[root@controller ~]# yum install centos-release-ceph-octopus.noarch -y
% G% `2 j3 Z# g2 V) |[root@computer ~]# yum install centos-release-ceph-octopus.noarch -y
5 }* I* B8 b1 J& i9 O' Z* H& Z安装ceph组件

$ f' n; ?8 M& Z[root@controller ~]# yum install cephadm -y
! r5 Z8 Q% L8 i( ?& q[root@computer ~]# yum install ceph -y
computer结点安装libvirt
7 Y" Z% @* n0 a
+ K9 d- p# v, @6 J! \. h/ G[root@computer ~]# yum install libvirt -y
$ m6 }8 N2 d6 j部署ceph集群
/ ~8 U8 p+ B2 C3 J8 m创建集群
3 d" O$ x7 I# Q- Z, k4 u
& Y) T5 B, N0 I, ^" n[root@controller ~]# mkdir -p /etc/ceph
& E- E8 P& o7 g+ X# p$ H[root@controller ~]# cd /etc/ceph/
7 I; j' G4 N5 O: B# G[root@controller ceph]# cephadm boostrap --mon-ip 192.168.29.148
[root@controller ceph]# ceph status
0 {. U/ {8 E) x( U0 u1 v9 w[root@controller ceph]#  cephadm install ceph-common
[root@controller ceph]# ssh-copy-id -f -i /etc/ceph/ceph.pub root@computer
. C$ f1 s0 K1 e1 Y修改配置
) R4 ~! ~. h, {, g
[root@controller ceph]# ceph config set mon public_network 192.168.29.0/24
添加主机
6 J, a- ]  [- w/ `2 A1 a
# d! ?2 L$ O& ~[root@controller ceph]# ceph orch host add computer
& [/ B- z+ _# o4 K0 l! |8 V[root@controller ceph]# ceph orch host ls
' t5 F' }0 ^! Y; \初始化集群监控

[root@controller ceph]# ceph orch host label add controller mon
[root@controller ceph]# ceph orch host label add computer mon
: i3 `4 ^* T# t0 C$ G0 x" V[root@controller ceph]# ceph orch apply mon label:mon
[root@controller ceph]# ceph orch daemon add mon computer:192.168.29.149
创建OSD
& s* O1 Z  p8 C9 Y
[root@controller ceph]# ceph orch daemon add osd controller:/dev/nvme0n2
[root@controller ceph]# ceph orch daemon add osd computer:/dev/nvme0n3
查看集群状态

; e2 w) z5 q/ L- o2 ^[root@controller ceph]# ceph -s
查看集群容量
) j0 p0 u7 X' U+ j- E1 r
+ ]1 J" n$ E5 L: P* W7 V, x5 O[root@controller ceph]# ceph df
# }. @' l+ T. j2 z9 f1 P创建pool

[root@controller ceph]# ceph osd pool create volumes 64
9 f" d, N% V8 `& B9 ][root@controller ceph]# ceph osd pool create vms 64

- O6 [7 I- ~% ?1 m) Y$ P+ B#设置自启动
" [' j" b# m; n0 q- Y3 ^[root@controller ceph]# ceph osd pool application enable vms mon
[root@controller ceph]# ceph osd pool application enable volumes mon
查看mon,osd,pool状态

3 }! q" w( e; S9 u  t! D8 |$ d[root@controller ceph]# ceph mon stat
[root@controller ceph]#  ceph osd status
[root@controller ceph]# ceph osd lspools
查看pool情况

2 Q) w2 J( n% h. X[root@controller ~]# rbd ls vms
[root@controller ~]# rbd ls volumes

admin

RUNNING THE BOOTSTRAP COMMAND
Run the ceph bootstrap command:

' H9 T" Z- o* I: ncephadm bootstrap --mon-ip *<mon-ip>*
; M" p3 D/ W2 X: G' AThis command will:

Create a monitor and manager daemon for the new cluster on the local host.

Generate a new SSH key for the Ceph cluster and add it to the root user’s /root/.ssh/authorized_keys file.
$ S0 q' x5 L9 u: C
Write a copy of the public key to /etc/ceph/ceph.pub.
) N) r6 P5 t' k
Write a minimal configuration file to /etc/ceph/ceph.conf. This file is needed to communicate with the new cluster.
: g  b: m' }: @4 {+ W1 K; G1 K
1 k) ?- T0 b5 Q0 h/ X) @Write a copy of the client.admin administrative (privileged!) secret key to /etc/ceph/ceph.client.admin.keyring.

2 V5 F$ ~; o; g& m2 M* ~9 wAdd the _admin label to the bootstrap host. By default, any host with this label will (also) get a copy of /etc/ceph/ceph.conf and /etc/ceph/ceph.client.admin.keyring.
7 W! C# ?8 F4 e+ t
FURTHER INFORMATION ABOUT CEPHADM BOOTSTRAP
The default bootstrap behavior will work for most users. But if you’d like immediately to know more about cephadm bootstrap, read the list below.
. W6 t3 R. o: U
& N& Z% P& o5 o& B! r; ^3 N3 sAlso, you can run cephadm bootstrap -h to see all of cephadm’s available options.

By default, Ceph daemons send their log output to stdout/stderr, which is picked up by the container runtime (docker or podman) and (on most systems) sent to journald. If you want Ceph to write traditional log files to /var/log/ceph/$fsid, use --log-to-file option during bootstrap.

% r; S3 n$ u$ V7 K3 B. jLarger Ceph clusters perform better when (external to the Ceph cluster) public network traffic is separated from (internal to the Ceph cluster) cluster traffic. The internal cluster traffic handles replication, recovery, and heartbeats between OSD daemons. You can define the cluster network by supplying the --cluster-network option to the bootstrap subcommand. This parameter must define a subnet in CIDR notation (for example 10.90.90.0/24 or fe80::/64).
' s6 ]9 v  j& V( O2 O2 x
) h' F* K* }' E. gcephadm bootstrap writes to /etc/ceph the files needed to access the new cluster. This central location makes it possible for Ceph packages installed on the host (e.g., packages that give access to the cephadm command line interface) to find these files.
4 {0 y" G: O; X: T! Z
. \5 m5 r, g' q) xDaemon containers deployed with cephadm, however, do not need /etc/ceph at all. Use the --output-dir *<directory>* option to put them in a different directory (for example, .). This may help avoid conflicts with an existing Ceph configuration (cephadm or otherwise) on the same host.

8 p) q2 [# S% [, B7 P: @) J3 fYou can pass any initial Ceph configuration options to the new cluster by putting them in a standard ini-style configuration file and using the --config *<config-file>* option. For example:
3 f+ s6 S# P7 }$ Y( }' x
% k* N# q1 H3 V/ a9 Rcat <<EOF > initial-ceph.conf
[global]
0 T) B5 L, W6 \osd crush chooseleaf type = 0
3 v- t' \) ~6 aEOF
0 `, H6 X1 e+ ?./cephadm bootstrap --config initial-ceph.conf ...
% s; N; W  F# q) Q# Q7 T" HThe --ssh-user *<user>* option makes it possible to choose which ssh user cephadm will use to connect to hosts. The associated ssh key will be added to /home/*<user>*/.ssh/authorized_keys. The user that you designate with this option must have passwordless sudo access.
9 {  U$ ^6 n1 a/ ?8 b
0 G& t/ e2 X, k5 {If you are using a container on an authenticated registry that requires login, you may add the three arguments:

& i; s. o9 @) Z* N/ P* D0 M--registry-url <url of registry>
& d$ I8 q; I1 Y3 o) b2 d
) o3 n7 A' S5 q" g* W; d--registry-username <username of account on registry>
) L9 k# r" l# f7 j& ?" f
% e& s# T* T6 {6 E--registry-password <password of account on registry>

OR
& [# i0 X/ d# l% l% ]8 R9 G! L
--registry-json <json file with login info>

+ q: S  x, i& X3 hCephadm will attempt to log in to this registry so it can pull your container and then store the login info in its config database. Other hosts added to the cluster will then also be able to make use of the authenticated registry.
# H* G& {1 v& n" ^
ENABLE CEPH CLI
Cephadm does not require any Ceph packages to be installed on the host. However, we recommend enabling easy access to the ceph command. There are several ways to do this:
1 a6 M+ e' E( Y, w, r% {
The cephadm shell command launches a bash shell in a container with all of the Ceph packages installed. By default, if configuration and keyring files are found in /etc/ceph on the host, they are passed into the container environment so that the shell is fully functional. Note that when executed on a MON host, cephadm shell will infer the config from the MON container instead of using the default configuration. If --mount <path> is given, then the host <path> (file or directory) will appear under /mnt inside the container:
8 Z: I4 Q1 m& }4 r  Q( k
1 k* c+ _# ~6 I! w8 fcephadm shell
To execute ceph commands, you can also run commands like this:
6 ?+ Z1 m! [& n: C. x
cephadm shell -- ceph -s
You can install the ceph-common package, which contains all of the ceph commands, including ceph, rbd, mount.ceph (for mounting CephFS file systems), etc.:
7 p% z) r( ^+ O- G7 c7 U8 m
4 k3 n9 z( ~- [cephadm add-repo --release pacific
cephadm install ceph-common
Confirm that the ceph command is accessible with:

ceph -v
Confirm that the ceph command can connect to the cluster and also its status with:

0 e9 f5 c( {" S- k. D) }2 X( x4 l. @1 |. Sceph status
ADDING HOSTS
5 s& v. F; X( V3 |Next, add all hosts to the cluster by following Adding Hosts.

/ v2 C9 ?8 Z% R, R0 N" aBy default, a ceph.conf file and a copy of the client.admin keyring are maintained in /etc/ceph on all hosts with the _admin label, which is initially applied only to the bootstrap host. We usually recommend that one or more other hosts be given the _admin label so that the Ceph CLI (e.g., via cephadm shell) is easily accessible on multiple hosts. To add the _admin label to additional host(s),
  Q8 H- x. S, e$ m; P9 W
ceph orch host label add *<host>* _admin
" f4 |; a( d! z8 b2 W- r* iADDING ADDITIONAL MONS
A typical Ceph cluster has three or five monitor daemons spread across different hosts. We recommend deploying five monitors if there are five or more nodes in your cluster.

' h2 }$ g, I6 Q8 |& @2 UPlease follow Deploying additional monitors to deploy additional MONs.

ADDING STORAGE
To add storage to the cluster, either tell Ceph to consume any available and unused device:
. J3 Y: s, p% m1 g% ~/ E5 D2 W5 ?4 F
ceph orch apply osd --all-available-devices
; B& C4 t$ S" C5 a1 t( }0 TOr See Deploy OSDs for more detailed instructions.

admin

cat <<EOF > initial-ceph.conf
[global]
9 k- E, S  ^! M: X' v7 `2 m osd crush chooseleaf type = 0
5 H! ^8 L0 ^( ?# q EOF
7 V( e0 F2 s8 p8 ?4 s ./cephadm bootstrap --config initial-ceph.conf --mon-ip *<mon-ip>*

cephadm shell

admin

To deploy an iSCSI gateway, create a yaml file containing a service specification for iscsi:
4 Q; Q5 B  Y! B9 _1 P  r" T
9 T5 M/ E4 f" T9 ?service_type: iscsi
: E8 t3 M% |. v& j' h6 Nservice_id: iscsi
4 O+ q1 g& n1 ?# x1 {0 l$ g6 Bplacement:
  hosts:
    - host1
    - host2
5 C: X0 G2 |$ Y: C- [spec:
  pool: mypool  # RADOS pool where ceph-iscsi config data is stored.
7 P5 Y7 U' X. s  trusted_ip_list: "IP_ADDRESS_1,IP_ADDRESS_2"
8 I) x* v! P. c- z/ b  api_port: ... # optional
  api_user: ... # optional
  api_password: ... # optional
  api_secure: true/false # optional
% @) o& n5 j- @  ssl_cert: | # optional
    ...
  ssl_key: | # optional
/ G& A- o$ @/ @    ...
For example:
/ v- X5 q( J4 w: m
service_type: iscsi
service_id: iscsi
6 p2 I' n3 y; {' y, K' u  uplacement:
  hosts:
( B2 P6 N% v3 |0 z6 g% G' K  - [...]
3 X# n% _4 C7 K) Vspec:
# v8 @' w3 z% t3 V7 o- U  pool: iscsi_pool
  trusted_ip_list: "IP_ADDRESS_1,IP_ADDRESS_2,IP_ADDRESS_3,..."
  api_user: API_USERNAME
  api_password: API_PASSWORD
9 o9 f" |7 ^6 K) v: N  api_secure: true
  ssl_cert: |
    -----BEGIN CERTIFICATE-----
# r# b+ u9 h1 g' m7 m0 u    MIIDtTCCAp2gAwIBAgIYMC4xNzc1NDQxNjEzMzc2MjMyXzxvQ7EcMA0GCSqGSIb3
    DQEBCwUAMG0xCzAJBgNVBAYTAlVTMQ0wCwYDVQQIDARVdGFoMRcwFQYDVQQHDA5T
' `2 _  W. h+ W  u+ Y( }! F6 b, ^    [...]
    -----END CERTIFICATE-----
/ q/ ~7 c6 o9 m! S& f  ssl_key: |
7 S, B& f6 N5 |+ w0 V    -----BEGIN PRIVATE KEY-----
: R" N0 p$ B6 ?8 W+ H: M    MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC5jdYbjtNTAKW4
    /CwQr/7wOiLGzVxChn3mmCIF3DwbL/qvTFTX2d8bDf6LjGwLYloXHscRfxszX/4h
- a! i/ l5 e0 @- i8 E    [...]
    -----END PRIVATE KEY-----
# i, h4 u1 m; ]" f- @( ?2 ]: qThe specification can then be applied using:

ceph orch apply -i iscsi.yaml

admin

ceph orch apply mon --unmanaged
! \% j& m3 {) J& b7 g8 tceph orch apply mon --unmanaged
: ^4 C2 |( f+ P1 P& H
ceph orch daemon add mon newhost1:10.1.2.123

ceph orch daemon add mon newhost2:10.1.2.0/24
% q3 I$ a7 }9 e9 b6 v9 {  V
% c( o5 i3 ]5 T* @3 w1 V0 P
+ O" @% s4 X( P8 G2 S# C( dceph orch apply mon "host1,host2,host3"

admin

环境介绍
8 U5 N, g: M, OIP地址 配置 主机名 Ceph版本
6 h. f9 b) Q2 d/ Q- ~) G9 }10.15.253.161 c2m8h300 cephnode01 Octopus 15.2.4
: Q2 m% V4 K( d. J' J10.15.253.193 c2m8h300 cephnode02 Octopus 15.2.4
10.15.253.225 c2m8h300 cephnode03 Octopus 15.2.4
2 n* H5 L. J, ~8 d+ W) ?) F9 ?
% S: X) X5 i. J, z#Linux系统版本
0 K7 @# \8 l* y+ l6 o, C[root@cephnode01 ~]# cat /etc/redhat-release
CentOS Linux release 8.2.2004 (Core)
5 Y* Y- [* k3 i3 b) Z  N) `+ H[root@cephnode01 ~]# uname -r
4.18.0-193.14.2.el8_2.x86_64
. O5 n3 h. M0 J3 w
4 b4 Z- y* n4 f4 C! `/ L* D& j#网络设计:建议各网络单独分开
10.15.253.0/24 #Public Network  公共网络
( ^2 n+ \- k5 P* J% N$ E' H0 E9 M$ \% N- H172.31.253.0/24 #Cluster Network 集群网络
! _9 [- P$ s+ U7 ~. N3 b+ d/ q: Y#每台ceph节点下除系统盘外，最少挂载两块相同的大容量硬盘，不需要进行分区
4 q5 H( @9 m4 p1 C$ d[root@cephnode01 ~]# lsblk
NAME   MAJ:MIN RM  SIZE RO TYPE MOUNTPOINT
sda      8:0    0   20G  0 disk
+ U1 c9 V4 s  G- L: L├─sda1   8:1    0  200M  0 part /boot
& p1 v% G- Q; u4 l& y$ f├─sda2   8:2    0    1G  0 part [SWAP]
└─sda3   8:3    0 18.8G  0 part /
2 q$ ]. Q" a1 s0 r5 n( D" H$ A2 Bsdb      8:16   0   20G  0 disk
2.1.1 Ceph安装与版本选择
https://docs.ceph.com/docs/master/install/
ceph-deploy 是用于快速部署群集的工具；社区不再积极维护ceph-deploy。仅支持Nautilus版之前的Ceph版本上进行。它不支持RHEL8，CentOS 8或更新的操作系统。
2 o8 I: Q% a+ s8 v, N! r+ A+ e这里的系统环境是centos8系统，所以需要使用cephadm部署工具部署octopus版的ceph
2.1.2 基础环境准备
3 V! @* {  x7 Z全部Ceph节点上操作；以cephnode01节点为例；
9 L) A5 I/ `1 E5 P6 Z4 F" r& Q
0 {1 X$ H& {5 y( }! ?% Z2 t#（1）关闭防火墙：
systemctl stop firewalld
systemctl disable firewalld
1 I. S5 {6 b9 V#（2）关闭selinux：
sed -i 's/enforcing/disabled/' /etc/selinux/config
- F& z6 Z! C/ W9 ]* P+ N; ], Ysetenforce 0
#（3）在cephnode01上配置免密登录到cephnode02、cephnode03
( l8 f. Q& v) @; h" o) hdnf install sshpass -y
1 [) w( R) B* }0 X2 s. issh-keygen -t rsa -f ~/.ssh/id_rsa -P ''
for ip in 161 193 225 ;do sshpass -pZxzn@2020 ssh-copy-id -o StrictHostKeyChecking=no 10.15.253.$ip ;done
#（4）在cephnode01上添加主机名：已经配置过则不需要再次添加
cat >>/etc/hosts <<EOF
1 V! W" Q- ~; d4 B, O" a  W* t6 v10.15.253.161 cephnode01
) B9 ^" p- C, G10.15.253.193 cephnode02
- }1 n6 R/ ~+ p10.15.253.225 cephnode03
EOF
for ip in 193 225 ;do scp -rp /etc/hosts root@10.15.253.$ip:/etc/hosts ;done
0 I' O6 ^) |. ?9 s7 b5 ~#（5）设置文件连接数最大值
echo "ulimit -SHn 102400" >> /etc/rc.local
cat >> /etc/security/limits.conf << EOF
* soft nofile 65535
# [7 N  V3 e: X3 f4 C" ~* hard nofile 65535
EOF
#（6）内核参数优化
+ f+ M! H" [# Decho 'net.ipv4.ip_forward = 1' >>/etc/sysctl.conf
# {1 Z$ O6 h+ p8 `& U/ M& Q1 yecho 'kernel.pid_max = 4194303' >>/etc/sysctl.conf
#内存不足时低于此值，使用交换空间
6 _) A4 R) ?: P4 J& ?' Jecho "vm.swappiness = 0" >>/etc/sysctl.conf
& G4 N' a. b2 k3 qsysctl -p
#（7）同步网络时间和修改时区；已经添加不需要配置
( M( u/ l  f7 F8 N/ S, l安装chrony时间同步 同步cephnode01节点
yum install chrony -y
vim /etc/chrony.conf
server cephnode01 iburst
) }/ {; X# ~, Y---
systemctl restart chronyd.service
1 u! G! s: {) O  [+ f( ^+ qsystemctl enable chronyd.service
" r  B) G- f- |5 w3 Hchronyc sources
+ ]7 X( o# k) L) k#(8)read_ahead,通过数据预读并且记载到随机访问内存方式提高磁盘读操作
, K4 V( ^; \) t' d, ^! eecho "8192" > /sys/block/sda/queue/read_ahead_kb
& p4 Y7 `9 ]7 y& k#(9) I/O Scheduler，SSD要用noop(电梯式调度程序)，SATA/SAS使用deadline(截止时间调度程序)
  C& q  d& b& n1 E7 Y. D0 \#https://blog.csdn.net/shipeng1022/article/details/78604910
echo "deadline" >/sys/block/sda/queue/scheduler
echo "deadline" >/sys/block/sdb/queue/scheduler
#echo "noop" >/sys/block/sd[x]/queue/scheduler
$ r3 d, a" W5 f9 G$ k3. 添加Octopus版yum源

cat >>/etc/yum.repos.d/ceph.repo <<EOF
[Ceph]
name=Ceph packages for $basearch
baseurl=https://mirrors.aliyun.com/ceph/rpm-octopus/el8/$basearch
5 i+ j; V( w: \enabled=1
  I' x% t( k2 ^. ggpgcheck=0
% }& V0 k% X" s0 M* [' N$ M. utype=rpm-md
: v6 L5 B  v: C- z) C3 W! P; E) C[Ceph-noarch]
name=Ceph noarch packages
baseurl=https://mirrors.aliyun.com/ceph/rpm-octopus/el8/noarch
enabled=1
gpgcheck=0
: Y" w9 ?+ y# M0 a$ L3 T3 m5 ctype=rpm-md
[ceph-source]
( ?8 s. S2 e/ ^" cname=Ceph source packages
baseurl=https://mirrors.aliyun.com/ceph/rpm-octopus/el8/SRPMS
enabled=1
$ I) W1 F( d3 Egpgcheck=0
type=rpm-md
4 d7 o7 c- V7 XEOF
yum clean all && yum makecache
#安装基础软件
; ]5 U, ^# R: s  Lyum install net-tools wget vim bash-completion lrzsz unzip zip -y
( t# Z* `" e! y4. cephadm工具部署
https://docs.ceph.com/docs/master/cephadm/install/
在15版本，支持使用cephadm工具部署，ceph-deploy在14版本前都支持
6 C/ i" `/ B+ S) T- I8 {5 J4.1 拉取最新的cephadm并赋权
在cephnode01节点配置；

[root@cephnode01 ~]# curl --silent --remote-name --location https://github.com/ceph/ceph/raw/octopus/src/cephadm/cephadm
[root@cephnode01 ~]# chmod +x cephadm
$ c* y1 j2 q4 Z0 n/ r[root@cephnode01 ~]#ll
  @1 r; Q1 K% Y  {" O& x# g) {-rwxr-xr-x. 1 root root 184653 Sep 10 12:01 cephadm
( n3 \4 t/ Q3 ]" r) t* ~4 W4.2 使用cephadm获取octopus最新版本并安装
1 B1 l3 W& _. g6 O已手动配置为国内yum源，不需要按官方文档的步骤再进行添加yum源

  r% j# S" M/ p9 ?% [7 y) A/ m#全部ceph节点安装
[root@cephnode01 ~]# dnf install python3 podman -y
" L7 K5 B; O. g7 h) x6 i$ x3 b1 e[root@cephnode01 ~]# ./cephadm install
& U! H- Z; x8 P4 {) D& o...
9 g8 q' o" S: {[root@cephnode01 ~]# which cephadm
/usr/sbin/cephadm
5. 创建ceph新集群
5.1 指定管理节点
创建一个可以被任何访问Ceph集群的主机访问的网络，指定mon-ip，并将生成的配置文件写进/etc/ceph目录里
+ N% i; }1 D- x
[root@cephnode01 ~]# mkdir -p /etc/ceph
[root@cephnode01 ~]# cephadm bootstrap --mon-ip 10.15.253.161
...
        URL: https://cephnode01:8443/
2 v6 R- |# o( X8 d( F3 b        User: admin
    Password: 6v7xazcbwk
$ A$ f+ ~0 j. L  o& ~. @1 i+ F...
可登陆URL: https://cephnode01:8443/，首次登陆要修改密码，进行验证


5.2 将ceph命令映射到本地
Cephadm不需要在主机上安装任何Ceph包。但是，建议启用对ceph命令的简单访问。
* H+ [: L% q" M2 ecephadm shell命令在安装了所有Ceph包的容器中启动一个bash shell。默认情况下，如果在主机上的/etc/ceph中找到配置和keyring文件，它们将被传递到容器环境中，这样就可以完全正常工作了。
& ?5 h' u# T3 u% p( e+ P
[root@cephnode01 ~]# cephadm shell
[root@cephnode01 ~]# alias ceph='cephadm shell -- ceph'
[root@cephnode01 ~]# exit
#安装ceph-common包；包括ceph，rbd，mount.ceph的命令
" K0 _  y- v4 d! G4 D8 e! E, w[root@cephnode01 ~]# ephadm install ceph-common包；包括ceph，rbd，mount.ceph的命令
. b2 ~3 S, Q' D2 l0 j#查看版本
[root@cephnode01 ~]# ceph -v
ceph version 15.2.4 (7447c15c6ff58d7fce91843b705a268a1917325c) octopus (stable)
% S( {7 q& R0 H查看状态

, v  r6 ]" o. {3 R6 E[root@cephnode01 ~]# ceph status
: e9 g3 Y4 V' N! H! J  cluster:
$ u$ x4 b9 o2 s    id:     8a4fdb4e-f31c-11ea-be33-000c29358c7a
+ a, S7 o. J' D, {2 E, t    health: HEALTH_OK
# W. c5 R" p) V. P0 c    Reduced data availability: 1 pg inactive
    OSD count 0 < osd_pool_default_size 3
- i5 D# C3 V6 D, E7 w$ H
  services:
    mon: 1 daemons, quorum ceph135 (age 14m)
    mgr: ceph03.oesega(active, since 10m)
    osd: 0 osds: 0 up (since 31m), 0 in

' z# {+ q+ T9 i# V1 [; Q  P  data:
2 ]. q5 ^& }7 f" a  Y    pools:   1 pools, 1 pgs
    objects: 0 objects, 0 B
: G- @) m) v# _: R6 Y    usage:   0 B used, 0 B / 0 B avail
    pgs:     100.000% pgs unknown
             1 unknown
5.3 添加新节点进ceph集群
4 V! G9 Z) {) o( A
[root@cephnode01 ~]# ssh-copy-id -f -i /etc/ceph/ceph.pub root@cephnode02
[root@cephnode01 ~]# ssh-copy-id -f -i /etc/ceph/ceph.pub root@cephnode03
' s( |' U, q+ y6 {8 }6 `( W( |+ P[root@cephnode01 ~]# ceph orch host add cephnode02
Added host 'cephnode02'
[root@cephnode01 ~]# ceph orch host add cephnode03
Added host 'cephnode03'
5.4 部署添加 monitor
& z7 W, Y1 }* R+ t2 {! ]5 Z+ ~选择需要设置mon的节点，全选
3 x9 c: w; z; @3 f
. e+ ?# k( J  H9 g. q9 a[root@cephnode01 ~]# ceph orch host label add cephnode01 mon
8 i; K% w3 B, g" S- iAdded label mon to host cephnode01
[root@cephnode01 ~]# ceph orch host label add cephnode02 mon
% c/ B5 G( c, LAdded label mon to host cephnode02
: X! ~3 l5 A4 m5 u/ o; [[root@cephnode01 ~]# ceph orch host label add cephnode03 mon
3 y3 o$ ?' E. g) W0 Q% ^Added label mon to host cephnode03
: Q$ N9 Y8 [/ M( h[root@cephnode01 ~]# ceph orch host ls
HOST        ADDR        LABELS  STATUS  
1 f; H% F% l8 ~; Zcephnode01  cephnode01  mon            
) x5 i5 e; A5 acephnode02  cephnode02  mon            
cephnode03  cephnode03  mon
告诉cephadm根据标签部署mon，这步需要等待各节点拉取images并启动容器
. m( c5 u# G- B3 O( }9 w
[root@cephnode01 ~]# ceph orch apply mon label:mon
具体验证是否安装完成，其他两台节点可查看下
$ S; A- V7 B$ c: @7 u% K
[root@cephnode02 ~]# podman ps -a
...
[root@cephnode02 ~]# podman images
REPOSITORY                     TAG       IMAGE ID       CREATED         SIZE
! i% c7 b& \& J0 |) x) gdocker.io/ceph/ceph            v15       852b28cb10de   3 weeks ago     1 GB
" R2 ^" [! s7 I" ^% N' z' S. H9 mdocker.io/prom/node-exporter   v0.18.1   e5a616e4b9cf   15 months ago   24.3 MB
6. 部署OSD
6.1 查看可使用的硬盘

[root@cephnode01 ~]# ceph orch device ls
  @: S$ B1 s1 \* \7 qHOST    PATH      TYPE   SIZE  DEVICE  AVAIL  REJECT REASONS                        
- U6 n  x( B# I8 B& eceph01  /dev/sda  hdd   20.0G          False  locked, Insufficient space (<5GB) on vgs, LVM detected  
& \- X& l8 @( }8 m1 D1 t; f4 Rceph01  /dev/sdb  hdd   20.0G          True
" H) i% ~/ v9 e# pceph02  /dev/sda  hdd   20.0G          False  Insufficient space (<5GB) on vgs, LVM detected, locked  
ceph02  /dev/sdb  hdd   20.0G          True
7 |$ b& r* a& i& q0 Y9 ?- i* Bceph03  /dev/sda  hdd   20.0G          False  locked, Insufficient space (<5GB) on vgs, LVM detected  
ceph03  /dev/sdb  hdd   20.0G          True
* k1 C+ ]8 T) Y; i6.2 使用所有可用硬盘
2 W7 D( o  b+ p' U' Z' K
[root@cephnode01 ~]# ceph orch apply osd --all-available-devices
添加单块盘的方式

[root@cephnode01 ~]# ceph orch daemon add osd cephnode02:/dev/sdc
8 r9 V3 f4 U, I6.3 验证部署情况
, C$ t; E2 P9 _8 ^& v) h
[root@cephnode01 ~]# ceph osd df
ID  CLASS  WEIGHT   REWEIGHT  SIZE    RAW USE  DATA     OMAP     META      AVAIL   %USE  VAR   PGS  STATUS
0    hdd  0.01949   1.00000  20 GiB  1.0 GiB  3.8 MiB    1 KiB  1024 MiB  19 GiB  5.02  1.00    1      up
( f) C/ @7 J( a: M2 }; C& G 1    hdd  0.01949   1.00000  20 GiB  1.0 GiB  3.8 MiB    1 KiB  1024 MiB  19 GiB  5.02  1.00    1      up
2    hdd  0.01949   1.00000  20 GiB  1.0 GiB  3.8 MiB    1 KiB  1024 MiB  19 GiB  5.02  1.00    1      up
: N2 M, N- U2 g  N- g: z                       TOTAL  60 GiB  3.0 GiB   11 MiB  4.2 KiB   3.0 GiB  57 GiB  5.02                  
MIN/MAX VAR: 1.00/1.00  STDDEV: 0
7. 存储部署
: b. Y+ Z; R4 O( B2 O- q; c  c2 P7.1 CephFS部署
1 U- [9 F. t0 y. l部署cephfs的mds服务，指定集群名及mds的数量

; [9 l0 Q8 T2 I6 u: }5 K2 D3 `[root@cephnode01 ~]# ceph orch apply mds fs-cluster --placement=3

[root@cephnode01 ~]# ceph -s
  cluster:
    id:     8a4fdb4e-f31c-11ea-be33-000c29358c7a
( }9 W% f( J; j: `& H    health: HEALTH_OK

! l4 q2 I0 q) }; m2 i; N  services:
    mon: 3 daemons, quorum cephnode01,cephnode02,cephnode03 (age 1m)
# F* {) @+ s/ \9 I" A( O. B    mgr: cephnode01.oesega(active, since 49m), standbys: cephnode02.lphrtb, cephnode03.wkthtb
    mds:  3 up:standby
    osd: 3 osds: 3 up (since 51m), 3 in (since 30m)

  data:
    pools:   1 pools, 1 pgs
    objects: 0 objects, 0 B
% S% I: M1 A$ ?: W0 ?4 d! ]: m    usage:   3.0 GiB used, 57 GiB / 60 GiB avail
! W: K. j6 K! M$ O5 J    pgs:     1 active+clean
' Z  O, Z- u" S& w8 E3 \2 U: W7.2 部署RGW
, D5 P' d6 f8 p3 G! }! D创建一个领域

[root@cephnode01 ~]# radosgw-admin realm create --rgw-realm=rgw-org --default
* C& U' ]# f  S, o; g$ @( Y{
    "id": "43dc34c0-6b5b-411c-9e23-687a29c8bd00",
3 Q0 ]+ M2 J) P    "name": "rgw-org",
    "current_period": "ea3dd54c-2dfe-4180-bf11-4415be6ccafd",
    "epoch": 1
}
创建一个zonegroup区域组
; b; V: J6 o( ~, c
[root@cephnode01 ~]# radosgw-admin zonegroup create --rgw-zonegroup=rgwgroup --master --default
{
% k4 W; G! x4 W+ ]1 K7 w# r    "id": "1878ecaa-216b-4c99-ad4e-b72f4fa9193f",
    "name": "rgwgroup",
    "api_name": "rgwgroup",
! {) l3 |) E/ Z! U) C    "is_master": "true",
    "endpoints": [],
    "hostnames": [],
    "hostnames_s3website": [],
; l" X9 l$ \1 L0 W  D/ N- j! r    "master_zone": "",
' w: v* z1 ?; W    "zones": [],
    "placement_targets": [],
    "default_placement": "",
* k7 b- n, W  L0 j4 H    "realm_id": "43dc34c0-6b5b-411c-9e23-687a29c8bd00",
4 K) a1 b5 t* l- X$ I    "sync_policy": {
        "groups": []
    }
+ X% A& @1 K/ J}
: J: |' J& J, H) G% q$ Y$ [5 J2 u创建一个区域

( b# Y; L( L3 y[root@cephnode01 ~]# radosgw-admin zone create --rgw-zonegroup=rgwgroup --rgw-zone=zone-dc1 --master --default
{
    "id": "fbdc5f83-9022-4675-b98e-39738920bb57",
9 X4 n8 T( Q! Y. S2 a/ }4 n    "name": "zone-dc1",
    "domain_root": "zone-dc1.rgw.meta:root",
! n' h3 F+ n- A    "control_pool": "zone-dc1.rgw.control",
6 t- {2 h8 U  X9 i/ M    "gc_pool": "zone-dc1.rgw.log:gc",
    "lc_pool": "zone-dc1.rgw.log:lc",
    "log_pool": "zone-dc1.rgw.log",
    "intent_log_pool": "zone-dc1.rgw.log:intent",
    "usage_log_pool": "zone-dc1.rgw.log:usage",
    "roles_pool": "zone-dc1.rgw.meta:roles",
" U* S8 H. F* H3 p+ P, m    "reshard_pool": "zone-dc1.rgw.log:reshard",
/ k$ E0 b, p; [" x, ]    "user_keys_pool": "zone-dc1.rgw.meta:users.keys",
    "user_email_pool": "zone-dc1.rgw.meta:users.email",
    "user_swift_pool": "zone-dc1.rgw.meta:users.swift",
    "user_uid_pool": "zone-dc1.rgw.meta:users.uid",
    "otp_pool": "zone-dc1.rgw.otp",
    "system_key": {
9 D7 T; L- P, J' N        "access_key": "",
        "secret_key": ""
( Q/ v/ Q4 f# P) ^0 X. n' u    },
    "placement_pools": [
        {
            "key": "default-placement",
            "val": {
                "index_pool": "zone-dc1.rgw.buckets.index",
                "storage_classes": {
                    "STANDARD": {
                        "data_pool": "zone-dc1.rgw.buckets.data"
; V% s& C& Y8 W/ Q/ q! W+ y                    }
                },
. R7 {( V8 m- k# r                "data_extra_pool": "zone-dc1.rgw.buckets.non-ec",
* C/ U6 J8 K% W4 O* V, f                "index_type": 0
            }
6 c& t4 T8 T' q4 z7 w  A        }
    ],
    "realm_id": "43dc34c0-6b5b-411c-9e23-687a29c8bd00"
}
为特定领域和区域部署一组radosgw守护进程，这里只指定了两个节点开启rgw
" l3 C# V1 }, N$ ~8 x- M0 T1
[root@cephnode01 ~]# ceph orch apply rgw rgw-org zone-dc1 --placement="2 cephnode02 cephnode03"
6 K8 t# K) l; r  G验证

& q  |4 x9 _+ S  W  P[root@cephnode01 ~]# ceph -s
7 `' u4 O* d) d: q7 u  cluster:
    id:     8a4fdb4e-f31c-11ea-be33-000c29358c7a
0 _4 O: R8 }$ a& c5 q' V$ H5 O- R    health: HEALTH_OK
6 p4 g& V5 G5 \- M: g0 V3 v# C
. p: y% ]% d$ Q4 \. e" R+ I  services:
- u3 b& w; t1 r( K  w: `& c    mon: 3 daemons, quorum cephnode01,cephnode02,cephnode03 (age 1m)
    mgr: cephnode01.oesega(active, since 49m), standbys: cephnode02.lphrtb, cephnode03.wkthtb
    mds:  3 up:standby
    osd: 3 osds: 3 up (since 51m), 3 in (since 30m)
    rgw: 2 daemons active (rgw-org.zone-dc1.cephnode02.cdgjsi, rgw-org.zone-dc1.cephnode03.nmbbsz)
5 i* e# F7 k5 Z' l  data:
5 b& S" {! K' z, j5 @( O+ Q3 q    pools:   1 pools, 1 pgs
0 ^- c9 z3 N; y8 I6 Q    objects: 0 objects, 0 B
; O4 }/ t% {0 y7 [- o    usage:   3.0 GiB used, 57 GiB / 60 GiB avail
    pgs:     1 active+clean
为RGW开启dashborad
: L# K5 {6 \  U5 m7 B  i
#创建rgw的管理用户
[root@cephnode01 ~]# radosgw-admin user create --uid=admin --display-name=admin --system
# g& ~; w4 U6 T& S{
    "user_id": "admin",
/ k' V( ~$ C" n# N9 _1 B8 q+ B    "display_name": "admin",
    "email": "",
    "suspended": 0,
1 W6 A$ t1 O0 X4 x    "max_buckets": 1000,
    "subusers": [],
2 |2 ]8 j( d( B+ Y! s# O# r    "keys": [
& I! y# @# K/ L1 Q        {
            "user": "admin",
            "access_key": "WG9W5O9O11TGGOLU6OD2",
            "secret_key": "h2DfrWvlS4NMkdgGin4g6OB6Z50F1VNmhRCRQo3W"
+ E- A# {% c' T        }
    ],
    "swift_keys": [],
( }+ l& {* _. t% g; e7 b    "caps": [],
    "op_mask": "read, write, delete",
    "system": "true",
4 y( M/ _7 Q) p8 z    "default_placement": "",
    "default_storage_class": "",
+ U  I6 C6 Y4 Q4 C; _5 U    "placement_tags": [],
    "bucket_quota": {
6 `" g/ Q+ G  R3 Q5 h1 v* I        "enabled": false,
        "check_on_raw": false,
        "max_size": -1,
        "max_size_kb": 0,
2 q5 t7 \/ x2 f! Q2 n1 U        "max_objects": -1
    },
    "user_quota": {
! A/ k5 ?3 ~( i) D        "enabled": false,
3 v0 P! D6 ]& Q5 d- Y: a# N% X        "check_on_raw": false,
8 u% G; B- q5 h        "max_size": -1,
        "max_size_kb": 0,
        "max_objects": -1
) p4 b' P8 @- W' O- e0 y    },
5 M: b: i9 t, W' q    "temp_url_keys": [],
    "type": "rgw",
    "mfa_ids": []
}
% A, ~8 h1 \- y* o6 r9 u9 z设置dashboard凭证

[root@cephnode01 ~]# ceph dashboard set-rgw-api-access-key WG9W5O9O11TGGOLU6OD2
+ {4 Y& M8 [& ]. p0 ]3 k2 [Option RGW_API_ACCESS_KEY updated
[root@cephnode01 ~]# ceph dashboard set-rgw-api-secret-key h2DfrWvlS4NMkdgGin4g6OB6Z50F1VNmhRCRQo3W
Option RGW_API_SECRET_KEY updated
. `- V3 N$ d, \: w; J6 `0 {设置禁用证书验证、http访问方式及使用admin账号
2 o" i4 n( q3 `) F" ~
: L* y8 @" i1 ^- w, v' f' [ceph dashboard set-rgw-api-ssl-verify False
# L/ y- H' ^" G. U1 a  a+ i* hceph dashboard set-rgw-api-scheme http
  {: `% J0 C, Aceph dashboard set-rgw-api-host 10.15.253.225
- E. O" e- r" @7 Bceph dashboard set-rgw-api-port 80
+ l/ v1 a* w6 Tceph dashboard set-rgw-api-user-id admin
重启RGW

1 |: B6 P- Z4 V, o3 u4 [% Cceph orch restart rgw