Skip to content

Administration

Managing a running IOLake cluster — tenants, users, access keys, policies, buckets, warehouses, pools.

Admin endpoints sit under /_admin/* on the gateway. They require a system-admin credential (or tenant-admin scope for tenant-level operations) and follow the same SigV4 authentication flow as the public S3 API.

Topics

  • S3 Admin API — users, access keys, groups, policies, buckets, pools, quotas, cluster-info, host lifecycle (add-host / reboot), KMS backend config.
  • Bucket replication — targets, rules, what replicates, and how to watch it.
  • Iceberg REST Catalog — warehouse lifecycle (POST /_admin/warehouses auto-provisions the backing bucket), namespace + table CRUD, table-level policies, vended credentials.
  • CLI — iolakectl: configure, credentials, every command group, examples.
  • Identity and Access — tenants and tenant admins, disabling a tenant, suspending users and keys, IAM policies, groups and roles, per-tenant OIDC providers, temporary credentials from an OIDC token (STS), ACLs.
  • Public Access — anonymous requests, Block Public Access at bucket, tenant and cluster level, and policies that depend on where a request came from (named endpoints, client address).
  • Bucket Logging — S3 server access logs, per bucket, delivered as objects into a target bucket
  • Audit Stream — one event per request (who, from where, what, how it ended), streamed to the operator's targets and to each tenant's own; delivery guarantees and metrics.
  • Mutual TLS between the services: gRPC between gateway, meta, OSDs and the block gateway over mTLS; certificates, the chart, renewal.
  • Authentication — SigV4 signing, self-service access keys, OIDC provider configuration, session cookies for the console, STS-style vended credentials for Iceberg clients.
  • Gateway-side grep — POST /{bucket}/{key}?grep for single-object regex search, POST /{bucket}?grep for prefix scans. Returns NDJSON with byte offsets so agents can Range-fetch surrounding context. Designed for AI / LLM tool workloads where downloading a 10 GB file to grep it is not an option.