radosgw_prom_exporter

Prometheus exporter for Ceph RADOSGW usage, written in Rust.

A drop-in replacement for blemmenes/radosgw_usage_exporter (Python) with the same metric names and labels, plus a fallback kubectl mode for local dev when you don't have direct network access to the RGW.

Modes

Mode	Default	Use case	Per-scrape latency
http	yes	In-cluster sidecar / direct access to RGW admin API	~0.3 s
kubectl		Local dev, shells out via kubectl rook-ceph radosgw-admin	~8 s

The kubectl mode parallelises per-user calls (--concurrency, default 8) so it stays usable for ad-hoc debugging.

Requirements

• RADOSGW must have usage logging enabled (rgw enable usage log = true and friends; see the upstream Ceph docs).
• Admin API enabled (default).
• A user with caps: buckets=read, metadata=read, usage=read, users=read. With Rook, the rgw-admin-ops-user typically already has them.

Configuration

All flags accept an env var (Python-exporter names are kept where they overlap).

Flag	Env	Default	Notes
--source	RADOSGW_SOURCE	http	http or kubectl
--bind	BIND_ADDRESS	::
--port -p	VIRTUAL_PORT	9242
--store -S	STORE	us-east-1	Added as store label on every metric
--timeout -t	TIMEOUT	60	Per upstream call, seconds
--log-level -l	LOG_LEVEL	info	tracing-subscriber env-filter syntax
--tag-list -T	TAG_LIST	empty	Comma-separated bucket tag keys to surface as labels
--concurrency	RADOSGW_CONCURRENCY	8	Per-user lookup fan-out
http mode
--host -H	RADOSGW_SERVER	http://radosgw:80
--admin-entry -e	ADMIN_ENTRY	admin
--access-key -a	ACCESS_KEY	empty	Required for http
--secret-key -s	SECRET_KEY	empty	Required for http
--region	RADOSGW_REGION	= --store	Used in SigV4 credential scope only
--insecure -k	RADOSGW_INSECURE	false	Skip TLS verification
kubectl mode
--program	RADOSGW_PROGRAM	kubectl
--base-args	RADOSGW_BASE_ARGS	rook-ceph,radosgw-admin	Comma-separated

Running

HTTP (production)

ACCESS_KEY=… SECRET_KEY=… \
  radosgw_prom_exporter \
    --host https://rgw.example.com \
    --store us-east-1 \
    --port 9242

Then scrape http://<host>:9242/metrics.

kubectl (local dev)

Requires kubectl configured with the cluster, and the kubectl-rook-ceph plugin installed.

radosgw_prom_exporter --source kubectl --port 9242

You can override the invoker if you're not using rook-ceph:

radosgw_prom_exporter --source kubectl \
  --program kubectl \
  --base-args "-n,rook-ceph,exec,deploy/rook-ceph-tools,--,radosgw-admin"

Metrics

24 metric families, matching the Python exporter names byte-for-byte so existing dashboards keep working.

Metric	Type	Labels
radosgw_usage_ops_total	counter	bucket, owner, category, store [, tag…]
radosgw_usage_successful_ops_total	counter	bucket, owner, category, store [, tag…]
radosgw_usage_sent_bytes_total	counter	bucket, owner, category, store [, tag…]
radosgw_usage_received_bytes_total	counter	bucket, owner, category, store [, tag…]
radosgw_usage_bucket_bytes	gauge	bucket, owner, category, store [, tag…]
radosgw_usage_bucket_utilized_bytes	gauge	bucket, owner, category, store [, tag…]
radosgw_usage_bucket_objects	gauge	bucket, owner, category, store [, tag…]
radosgw_usage_bucket_quota_enabled	gauge	bucket, owner, category, store [, tag…]
radosgw_usage_bucket_quota_size	gauge	bucket, owner, category, store [, tag…]
radosgw_usage_bucket_quota_size_bytes	gauge	bucket, owner, category, store [, tag…]
radosgw_usage_bucket_quota_size_objects	gauge	bucket, owner, category, store [, tag…]
radosgw_usage_bucket_shards	gauge	bucket, owner, category, store [, tag…]
radosgw_user_metadata	gauge	user, display_name, email, storage_class, store
radosgw_usage_user_quota_enabled	gauge	user, store
radosgw_usage_user_quota_size	gauge	user, store
radosgw_usage_user_quota_size_bytes	gauge	user, store
radosgw_usage_user_quota_size_objects	gauge	user, store
radosgw_usage_user_bucket_quota_enabled	gauge	user, store
radosgw_usage_user_bucket_quota_size	gauge	user, store
radosgw_usage_user_bucket_quota_size_bytes	gauge	user, store
radosgw_usage_user_bucket_quota_size_objects	gauge	user, store
radosgw_usage_user_total_objects	gauge	user, store
radosgw_usage_user_total_bytes	gauge	user, store
radosgw_usage_scrape_duration_seconds	gauge	—

Quirk inherited from the Python version

For bucket_* metrics the third label is named category but actually holds the bucket's zonegroup. Kept as-is for dashboard compatibility.

Install via Helm

A Helm chart lives under charts/radosgw-prom-exporter-chart. It ships:

• PSS restricted-compliant securityContext by default (rootless, read-only FS, dropped capabilities).
• Optional ServiceMonitor (prometheus-operator).
• Optional CiliumNetworkPolicy that default-denies traffic and only allows DNS + the S3/radosgw endpoint(s) you configure (typically a pod selector in another namespace).

Each tagged release publishes the chart to Forgejo's OCI registry alongside the image:

helm install rgw-exporter oci://forge.netserv.fr/azsiaz/radosgw-prom-exporter-chart \
  --version <version> \
  --namespace observability --create-namespace \
  --set radosgw.server=https://rook-ceph-rgw-objstore.rook-ceph.svc:443 \
  --set auth.existingSecret=rgw-admin-ops-user

See the chart's README for the full values reference and CNP shapes.

Build

cargo build --release
# binary at target/release/radosgw_prom_exporter

Differences from the Python exporter

• Uses AWS SigV4 signing (Python uses S3v2 via awsauth). RGW accepts both.
• Adds a kubectl fallback source for local dev.
• Per-user lookups run concurrently (--concurrency).
• Pre-12.2.13 Ceph /metadata/user fallback is not implemented.
• Validated against the canonical AWS SigV4 test vector ("GET Object" with Range header) — cargo test.

License

Match upstream.