Delivering Enterprise-Grade Object Storage: Bloomberg’s IAM Journey in a Multi-Tenant Arch...
summary
Ceph-based clusters handle 2 billion requests/day and 250 TB/day across 10 clusters (largest at ~4,500 OSDs per site) backing ~3,000 tenants and ~77 PB total with ~450,000 buckets/DC. A custom control plane (UI + Airflow + PostgreSQL) implements tenant/account migration, role and policy management, and pre-created IAM roles to issue temporary STS tokens and combine role/resource policies. Deployment runs on bare metal, ships to internal zones, and works but requires ongoing backports to fix bucket-owner and root-user permission issues.
AI-written summary · about
chapters (6)
- 0:00Introduction and agenda
- 3:45Bloomberg’s scale and SEAF deployment
- 12:27Identity and Access Management in Squid
- 16:24Squid migration challenges and fixes
- 18:11Tenant migration to account model
- 23:21Q&A session
related talks
39mCeph in Scientific Computing and Large Clusters BoF
34mOver a Billion Requests Served per Day: Ensuring Everyone Is Happy with Our Ceph Clusters’...
39mDesigning & Securing Multi-Tenant Runtime Environment at the New York Times
01h 00mArchitecting multi-tenant PaaS offerings
09mStorage: managing billions of objects
28mDesigning and Securing a Multi-Tenant Runtime Environment at the New York Times
21mDedicated Infrastructure in a Multitenant World
29mManaging a Multi-Tenanted Kubernetes Cluster in Production