Ceph RGW Critical Bucket Inventory Sentinel

A Ceph RADOS Gateway (RGW) deployment's bucket inventory drifts silently - a backup bucket deleted by a misconfigured lifecycle policy, or a wave of ad hoc bucket creation nobody tracked - and nothing in Ceph itself proactively flags either case. This blueprint lists every bucket in the gateway on a schedule and alerts Slack the moment a named must-always-exist bucket is missing, or the total bucket count crosses a governance threshold.

How it works

1. periodic_inventory_check (io.kestra.plugin.core.trigger.Schedule) runs every 30 minutes, explicitly passing ceph_host, critical_bucket_name, and max_expected_bucket_count through its own inputs: block so the flow is self-contained when the trigger fires. Shipped disabled so a manual run can be verified first.
2. probe_list_buckets (io.kestra.plugin.ceph.rgw.ListBuckets) calls the Ceph Dashboard's own GET /api/rgw/bucket endpoint, capturing the bucket total count and the buckets name list.
3. evaluate_bucket_inventory (io.kestra.plugin.core.flow.If) checks, in order of severity:
   • CRITICAL_BUCKET_MISSING: critical_bucket_name is absent from buckets - alert_critical_bucket_missing fires immediately.
   • BUCKET_COUNT_EXCEEDED: the critical bucket is present, but total exceeds max_expected_bucket_count - alert_bucket_count_exceeded fires.
   • HEALTHY: the critical bucket is present and total is within threshold - log_inventory_healthy records the pass.
4. log_audit_complete always runs last, printing the final total regardless of which branch fired.
5. The errors block alerts Slack separately if the flow itself fails outright - an unreachable Ceph Dashboard or invalid credentials.

What you get

• A Drift Auditor / Resource Quota Enforcement sentinel built on Ceph's own bucket inventory, not on a separately-maintained spreadsheet of what buckets should exist.
• Two distinctly different severities kept apart: a missing must-always-exist bucket (likely lost data or a broken backup pipeline) versus unmanaged bucket count growth (a governance/cost signal) - each pointing toward a different response.
• A worked example of io.kestra.plugin.ceph.rgw.ListBuckets, with no prior blueprint coverage of this plugin's RGW (object gateway) surface in this repository - the existing Ceph blueprints here cover OSD peering, pool replication, RBD snapshots, and overall cluster health, a different subsystem entirely from the S3-compatible object gateway.

Who it's for

• Storage and platform teams operating Ceph RGW who need to know immediately if a critical bucket disappears, rather than discovering it during a restore.
• Teams enforcing bucket-provisioning governance who want a heads-up the moment bucket count grows past what is tracked, instead of finding out during a storage capacity review.
• Anyone evaluating the Ceph plugin who wants a worked example of its RGW task family used for monitoring rather than for provisioning buckets or users.

Why orchestrate this with Kestra

The Ceph Dashboard shows the current bucket list reactively, but has no built-in "alert me if a specific bucket disappears or the count grows too high" primitive. Kestra supplies the schedule, the CRITICAL_BUCKET_MISSING/BUCKET_COUNT_EXCEEDED/HEALTHY classification as a first-class three-way branch, and an execution history showing exactly when a bucket went missing or the count first crossed the threshold.

Prerequisites

• A Ceph cluster with the RGW (Object Gateway) service enabled and the Ceph Dashboard reachable.
• Ceph Dashboard credentials with read access to the RGW bucket list (update ceph_host, and the CEPH_USERNAME/CEPH_PASSWORD secrets).
• At least one bucket designated as the must-always-exist critical_bucket_name for your environment.
• A Slack incoming webhook for alerts.

Secrets

• CEPH_USERNAME / CEPH_PASSWORD: Ceph Dashboard credentials for io.kestra.plugin.ceph.rgw.ListBuckets, matching the secret naming already used by this repository's other Ceph blueprints.
• SLACK_WEBHOOK_URL: Slack incoming webhook used by both alert branches and the errors block.
• In Kestra OSS (no Enterprise secrets backend), secrets are supplied as environment variables prefixed SECRET_, base64-encoded - for example SECRET_CEPH_PASSWORD=$(echo -n '<your-local-password>' | base64) - and read back in flows with {{ secret('NAME') }}.

Inputs

• ceph_host (STRING, default ceph-mgr.internal): Ceph Dashboard host.
• critical_bucket_name (STRING, must be replaced): the bucket that must always exist.
• max_expected_bucket_count (INT, default 50): governance threshold on total bucket count.

Outputs

• outputs.probe_list_buckets.total (Integer): number of buckets returned (verified field from ListBuckets's own Output class).
• outputs.probe_list_buckets.buckets (List of String): bucket names in the gateway, only populated with the default FETCH fetch type used here.

Quick start

1. Identify a real Ceph RGW gateway and a bucket that must always exist in it.
2. Add the CEPH_USERNAME, CEPH_PASSWORD, and SLACK_WEBHOOK_URL secrets.
3. Run the flow manually and confirm log_inventory_healthy fires if the critical bucket exists and total count is within threshold.
4. Temporarily point critical_bucket_name at a bucket name that does not exist, and re-run to confirm alert_critical_bucket_missing fires.
5. Temporarily lower max_expected_bucket_count below the gateway's real bucket count, and re-run to confirm alert_bucket_count_exceeded fires.
6. Enable periodic_inventory_check once you trust the check against your real gateway.

How to extend

• Loop over several ceph_host values with io.kestra.plugin.core.flow.Loop to audit multiple RGW gateways in one run.
• Track multiple must-always-exist buckets by looping critical_bucket_name over a list input instead of a single value.
• Add a companion check using io.kestra.plugin.ceph.rgw.ListUsers (the same plugin's user-listing equivalent) to audit RGW user inventory for orphaned or unauthorized access-key holders alongside bucket drift.

Pitfalls

• ListBuckets returns bucket names only, not owner, size, or quota - verified directly from its own Output class (total and buckets, nothing else). This sentinel can prove a bucket exists or vanished, but cannot by itself detect a bucket that still exists but has silently exceeded its quota or changed owner.
• A large gateway should use fetchType: STORE (per the task's own documented guidance for "gateways with a large number of buckets") instead of the default FETCH used here, to avoid holding every bucket name in task output; this blueprint intentionally uses FETCH since both critical_bucket_name presence and total need to be evaluated inline.
• This blueprint cannot distinguish a deliberately deleted bucket from one impacted by an outage - CRITICAL_BUCKET_MISSING fires identically in both cases; the Slack alert is the start of an investigation, not a diagnosis.

Links

• Kestra Ceph plugin documentation
• Ceph Object Gateway (RGW) documentation
• Kestra secrets (OSS vs Enterprise)