First Steps

First login

Open your CDM_PUBLIC_URL and choose Single sign-on. You are sent to your identity provider and back; there is no separate CDM password.

There are two roles:

• admin adds, edits and removes clusters, mutes findings and sees the audit trail.
• viewer sees everything else, read-only.

Everyone who can log in is a viewer unless OIDC_ROLE_MAPPING grants more, so a new installation cannot be changed by accident. Single Sign-On explains how to map your groups.

Accept the license agreement

The first time someone signs in, CDM shows its End User License Agreement, in English and German, and can be used only once it is accepted. An admin accepts it once for the whole installation, for themselves or on behalf of the organization they run CDM for; a viewer who signs in first sees the agreement and is asked to have an administrator accept it. Download saves the text you are reading.

If you choose Decline, CDM stays unusable and says so; your clusters are not affected. You can read the agreement again and accept it, or sign out.

Afterwards, EULA in the menu shows the agreement and who accepted it when. An update that changes the agreement asks for an acceptance again.

Look around before connecting anything

A new installation is not empty. It comes with four demo clusters in different locations, with moving charts, live logs, health findings, tasks and audit entries. They are built into CDM, so nothing is contacted over the network and there is nothing to set up. It is the fastest way to see whether CDM is for you.

Two things are worth knowing:

• You still sign in first. CDM always authenticates against your own identity provider, so CDM does not start until the OIDC settings are in place. If the page does not load, docker logs cdm names the missing setting.
• The demo clusters have no cluster interface behind them, so there is no link to open one. Everything else behaves like the real thing.

Would you like your dashboard to show only your own clusters? Select a demo cluster in Clusters and choose Remove; removed demo clusters do not come back. To skip them entirely, set CDM_DEMO_CLUSTER=off before the first start.

You can rename a demo cluster and change its location, but not its address.

Add your clusters

Go to Clusters, then Add Cluster above the list, or open the map with Show map and click where the cluster is and choose Add a cluster here, which fills in its coordinates:

Field	What to put in
Name	How it appears in CDM, for example "Frankfurt production"
Base URL	The cluster's API address, for example https://10.0.0.10 for croit, or https://mgr-host:8443 for a Ceph Manager dashboard. Any manager works, CDM follows a standby's redirect.
Cluster Type	croit cluster or Ceph cluster (Manager dashboard). Not sure? Press Detect from URL and CDM works it out.
Authentication	An API token or a Username and password, the read-only credential from Installation. A Ceph cluster always uses a username and password.
Access	Read access (viewer), the default, or Write access (admin). CDM only changes a cluster registered with write access, whatever its credential could do, so a token with more rights than CDM needs is never used to change anything by accident. Write access needs a croit cluster, an administrator credential and a valid croit licence; see Setting up multisite.
Latitude, Longitude, Location	Optional. Where the cluster appears on the world map, and a label such as "Frankfurt". Clicking the map fills in both coordinates; the map shows your other clusters, named when you point at one.

When you save, CDM first signs in to the cluster, which takes a few seconds, and registers it only if that works. If it cannot, or if you chose Write access (admin) and the credential cannot change the cluster, the form stays open and says what to fix: the address, the credential, its role, or the cluster's licence. Correct it and save again, or choose Add anyway to register the cluster as it is, for example one that is not reachable yet; CDM keeps trying and shows it as not reachable until it connects. Once it connects, its card says so and the fleet numbers include it. Nothing else needs configuring: CDM polls each cluster continuously and open pages refresh themselves.

The Clusters page lists every registered cluster in a row: its name and location, its health with what it is short of (for example 1 OSD down) or its Ceph warnings, its servers, OSDs and MONs (a count short of its total in amber), its gateways by kind (S3, NFS and so on, a kind short of its instances in amber), how full it is (amber past the cluster's nearfull ratio, red past full, as Capacity counts it), its client IOPS and throughput, and its address with CDM's access, the type and the version, or Not reachable when CDM cannot reach it. Open UI, Edit and Remove are on each row; where a cluster's own interface cannot be opened, point at its disabled button to read why. Boxes above the list count the clusters by health (click Healthy, Warning, Error or Not reachable to list only those, again to list all). Capacity, Client I/O and Findings sum the fleet's fill, load and advisor findings and open their pages. Oldest release names the croit release furthest behind; click it to list the clusters on it. Show map above the boxes opens the whole world map beside them (Hide map in its top left corner folds it again); CDM remembers whether you left it open. On the map, pointing at a row marks its pin, Edit locations moves pins, and clicking an empty spot offers to add a cluster there; Click to add shows a crosshair with the position under the pointer, and the next click opens the form at that place, or at a cluster's pin with that cluster's location filled in. While editing, clusters close together are one counted bubble: drag it to move them together, or click it for their list and drag one out onto the map to move it on its own. In the form, click its map or drag the blue point to set the location; clicking another cluster's gray pin puts the point on it and fills an empty Location with that cluster's, which picking another place clears again. Pick a cluster in the page heading, or click its name, to open its own page, where its About card also holds Open UI, Edit and Remove; clear the pick to return to the list.

When you edit a cluster, leave the token or password empty to keep the saved one. Changing the authentication method or the Base URL needs the credential again, so a saved credential is never sent to another address. A cluster keeps its access mode until you change it, and every cluster registered before write access existed stays on read access.

Opening a cluster's full interface

CDM gives each proxied cluster interface its own host under the CDM domain, for example c-<cluster-id>.cdm.example.com. A production deployment that uses Open UI needs all of the following:

• cdm.example.com and *.cdm.example.com resolve to the same reverse proxy.
• The TLS certificate covers both cdm.example.com and *.cdm.example.com.
• The reverse proxy sends both hosts to the CDM container and preserves the original Host header.

The interface opens in a new tab and is read-only: CDM refuses any change through it. For a Ceph cluster, it opens the Ceph dashboard.

The cluster id is generated by CDM, so individual DNS records are not practical. On localhost, the wildcard host works without a production DNS setup.