First Steps

First login

Open your CCD_PUBLIC_URL and choose Single sign-on. You are sent to your identity provider and back; there is no separate CCD password.

There are two roles:

• admin adds, edits and removes clusters, mutes findings and sees the audit trail.
• viewer sees everything else, read-only.

Everyone who can log in is a viewer unless OIDC_ROLE_MAPPING grants more, so a new installation cannot be changed by accident. Single Sign-On explains how to map your groups.

Look around before connecting anything

A new installation is not empty. It comes with four demo clusters in different locations, with moving charts, live logs, health findings, tasks and audit entries. They are built into CCD, so nothing is contacted over the network and there is nothing to set up. It is the fastest way to see whether CCD is for you.

Two things are worth knowing:

• You still sign in first. CCD always authenticates against your own identity provider, so CCD does not start until the OIDC settings are in place. If the page does not load, docker logs ccd names the missing setting.
• The demo clusters have no cluster interface behind them, so there is no link to open one. Everything else behaves like the real thing.

Would you like your dashboard to show only your own clusters? Select a demo cluster in Clusters and choose Remove; removed demo clusters do not come back. To skip them entirely, set CCD_DEMO_CLUSTER=off before the first start.

You can rename a demo cluster and change its location, but not its address.

Add your clusters

Go to Clusters, then Add Cluster:

Field	What to put in
Name	How it appears in CCD, for example "Frankfurt production"
Base URL	The cluster's API address, for example https://10.0.0.10 for croit, or https://mgr-host:8443 for a Ceph Manager dashboard. Any manager works, CCD follows a standby's redirect.
Cluster Type	croit cluster or Ceph cluster (Manager dashboard). Not sure? Press Detect from URL and CCD works it out.
Authentication	A Viewer API token or a Username and password, the read-only credential from Installation. A Ceph cluster always uses a username and password.
Latitude, Longitude, Location	Optional. Where the cluster appears on the world map, and a label such as "Frankfurt". Clicking the map fills in both coordinates.

The tile turns green within a few seconds and the fleet numbers include it. Nothing else needs configuring: CCD polls each cluster continuously and open pages refresh themselves.

When you edit a cluster, leave the token or password empty to keep the saved one. Changing the authentication method needs a new credential.

Opening a cluster's full interface

CCD gives each proxied cluster interface its own host under the CCD domain, for example c-<cluster-id>.ccd.example.com. A production deployment that uses Open full UI needs all of the following:

• ccd.example.com and *.ccd.example.com resolve to the same reverse proxy.
• The TLS certificate covers both ccd.example.com and *.ccd.example.com.
• The reverse proxy sends both hosts to the CCD container and preserves the original Host header.

The interface opens in a new tab and is read-only: CCD refuses any change through it. For a Ceph cluster, it opens the Ceph dashboard.

The cluster id is generated by CCD, so individual DNS records are not practical. On localhost, the wildcard host works without a production DNS setup.