Best practices for secure deployment
Security must be incorporated from the beginning of your Charmed Ceph deployment.
Network Architecture
- Segmentation: Use separate physical or logical (VLAN) networks for different access levels
- External (optional): If applicable, expose specific endpoints for external untrusted consumption, e.g. RGW.
- Storage Access: Client access (including RGW if no external access provided), MON access.
- Cluster Network: OSD replication and heartbeat traffic. Isolating this improves performance and security.
- Firewalls: Implement strict firewall rules (e.g. using iptables, nftables) on all nodes:
- Deny all traffic by default.
- Allow only necessary ports between specific hosts/networks (refer to the port table).
- Restrict access to management interfaces (SSH, Juju, Dashboard) to trusted administrative networks.
Minimum Privileges
- Cephx Keys: Create dedicated Cephx keys for each client/application with the minimum required capabilities. Do not use the admin key for routine access.
- Juju Roles: Assign Juju users the least permissive role (e.g., read, write) necessary for their tasks on specific models. Reserve admin rights carefully.
- OS Users: Limit sudo access on host machines. Run services under dedicated, unprivileged users where possible (though OSDs inherently require higher privileges for device access, mitigated by containers/snaps). Apply the least privilege principle rigorously across all layers.
- Explicit Assignment: Ensure that all access, whether via Cephx, Dashboard, or RGW, relies on explicit assignment of permissions/capabilities rather than default permissive settings. Limit permissions strictly to what is needed for the operation.
Auditing and Centralized Logging
- Enable Auditing: Configure Ceph logging to capture significant events.
- Centralized Logging: Forward logs from all Ceph nodes, host systems (syslog, auth.log), and Juju components to a central logging system (such as Loki, Splunk). This facilitates correlation and analysis.
- Monitor and Audit: Regularly review logs for anomalies, security events (e.g. repeated auth failures).
Alerting
- Configure Monitoring: Use the built-in Ceph monitoring (Prometheus exporter via MGR module) and integrate it with an alerting system such as the Canonical Observability Stack.
- Security Alerts: Configure alerts for security anomalies and critical health issues, such as:
- Ceph health status changes (HEALTH_WARN, HEALTH_ERR).
- Daemon crashes or restarts.
- Near-full OSDs/pools.
- Significant performance deviations.