How to enable the Ceph Dashboard

The Ceph Dashboard gives storage administrators a browser view of cluster health, manager services, pools, OSD state, and storage features that are otherwise checked from the ceph CLI. Enabling it is useful after a cephadm bootstrap, manager redeploy, or hardened cluster build where command-line administration works but the web console is not ready for operators.

The dashboard runs as a ceph-mgr module on the active manager daemon. SSL is enabled by default, the usual HTTPS listener is port 8443, and ceph mgr services advertises the URL that a browser should use after the module is running.

Use a Ceph administrator shell on a host with cluster configuration and a privileged keyring, or run the same commands through cephadm shell when the host does not have local admin files. A self-signed certificate is enough for an isolated lab, but a production dashboard should use a CA-issued RSA certificate and a named administrator account whose password is not left in shell history.

1. Open a shell that can run Ceph administrator commands.

   $ ceph -s
     cluster:
       id:     11111111-2222-3333-4444-555555555555
       health: HEALTH_OK
   
     services:
       mon: 3 daemons, quorum ceph-node1,ceph-node2,ceph-node3 (age 2h)
       mgr: ceph-admin.a1b2c3(active, since 2h), standbys: ceph-node2
   ##### snipped #####

   Use sudo cephadm shell -- ceph -s when the admin keyring is not installed on the current host.
   Related: How to check Ceph cluster health

2. Enable the dashboard manager module.

   $ ceph mgr module enable dashboard

   No output means the manager accepted the module-enable request. If the module was already enabled, Ceph leaves it enabled.

3. Confirm that the dashboard module is enabled.

   $ ceph mgr module ls
   MODULE
   balancer                 on
   crash                    on
   dashboard                on
   devicehealth             on
   prometheus               on
   restful                  off
   ##### snipped #####

4. Create a self-signed dashboard certificate for first access.

   $ ceph dashboard create-self-signed-cert
   Self-signed certificate created

   Browsers warn on this certificate because it is not signed by a trusted CA. For production access, install a CA-issued RSA certificate with ceph dashboard set-ssl-certificate and ceph dashboard set-ssl-certificate-key, then reload the manager module.

5. Create a root-readable password file for the new dashboard administrator.

   $ sudo install -m 600 /dev/null /root/dashboard-admin-password.txt

6. Store a strong temporary password in the password file.

   $ sudoedit /root/dashboard-admin-password.txt

   Save exactly one password line. Avoid echo commands that place dashboard credentials in shell history.

7. Create a named dashboard administrator account.

   $ ceph dashboard ac-user-create storage-admin -i /root/dashboard-admin-password.txt administrator

   The final argument assigns the built-in administrator role to the new user. Use a person-specific or team-specific account name instead of sharing the bootstrap admin login.

8. Confirm that the account is enabled and has the administrator role.

   $ ceph dashboard ac-user-show storage-admin
   {
       "username": "storage-admin",
       "roles": [
           "administrator"
       ],
       "name": null,
       "email": null,
       "enabled": true,
       "pwdExpirationDate": null,
       "pwdUpdateRequired": false
   }

9. List the manager service URLs.

   $ ceph mgr services
   {
       "dashboard": "https://ceph-admin:8443/",
       "prometheus": "http://ceph-admin:9283/"
   }

   If the dashboard key is missing, check the active manager log and re-enable the module after certificate changes.

10. Test the HTTPS listener from a host that can reach the active manager.

    $ curl --insecure --head https://ceph-admin:8443/
    HTTP/1.1 200 OK
    Content-Type: text/html; charset=utf-8
    Server: CherryPy/18.10.0
    Date: Mon, 29 Jun 2026 08:20:31 GMT

    Use --insecure only for the self-signed certificate check. Remove it after installing a CA-issued certificate that the client trusts.

11. Open the dashboard URL in a browser and sign in as storage-admin.

    https://ceph-admin:8443/

    A successful sign-in opens the dashboard overview with cluster health, capacity, and service panels. A certificate warning is expected only while the self-signed certificate is in use.

12. Remove the temporary password file after the login test succeeds.

    $ sudo rm /root/dashboard-admin-password.txt