Apache Ozone Configuration

ChartVersion3.0.1TypeapplicationAppVersion2.0.0

CompatibilityKubernetes1.32+OpenShift4.19+Rancher2.10.x+

Feature SupportS3supportedIngresssupportedGateway APIsupported

What is Apache Ozone in TDP?

Apache Ozone is the S3-compatible object storage used by TDP Kubernetes to provide an in-cluster data backend. It serves workloads that read or write objects, such as Spark jobs, Trino catalogs, Iceberg or Delta Lake tables, and S3-compatible clients.

Helm value structure

Apache Ozone values are placed under the tdp-ozone: key (the dependency alias in Chart.yaml). Internal Ozone subchart configurations are nested under ozone:. HTTP/HTTPS exposure settings go under TDP-Settings: and ingress:.

TDP-Settings:
  gateway:
    ingress:
      enabled: false

ozone:
  datanode:
    replicas: 3
    persistence:
      enabled: true
      size: 50Gi

Architecture

The Ozone deployment is composed of services with distinct roles:

Service	Role	Default port
S3 Gateway REST	Data plane compatible with the S3 API for object reads and writes	9878
S3 Gateway Web UI	S3 Gateway web interface for operational inspection	19878
Ozone Manager (OM)	Manages volumes, buckets, keys, and namespace metadata	9874
Storage Container Manager (SCM)	Coordinates containers, pipelines, and block placement on datanodes	9876
Datanodes	Store object data on persistent or ephemeral volumes	9882

Applications normally use only the S3 Gateway REST endpoint. OM, SCM, and the S3 Gateway Web UI are administrative or observability interfaces and should be exposed with tighter restrictions.

Overview

Item	Value
Chart	tdp-ozone
Application version	Apache Ozone 2.0.0
OCI registry	oci://registry.tecnisys.com.br/tdp/charts/tdp-ozone
Internal S3 endpoint	http://<RELEASE_NAME>-s3g-rest.<NAMESPACE>.svc.cluster.local:9878

Related pages

• Integrations - Apache Ozone explains how TDP consumers use the S3 endpoint.
• Security - Apache Ozone details AWS Signature v4, Secrets, TLS, and credential rotation.
• Ingress - Apache Ozone shows how to expose OM, SCM, S3 Web UI, and S3 REST.

Prerequisites

Before installing, confirm:

• Kubernetes 1.32+, Red Hat OpenShift 4.19+, or Rancher Manager 2.10.x+.
• Helm 3.2.0+.
• StorageClass available for components that use persistence.
• Ingress Controller or Gateway API only when HTTP/HTTPS exposure outside the cluster is required.
• S3 credentials Secret when ozone.s3g.auth.enabled remains enabled.

Installation

Installation

During installation, the chart automatically creates the default ozone-s3-credentials Secret with S3 credentials. Manual creation is only necessary when you want to use custom credentials — in that case, create the Secret before deployment:

Terminal input

kubectl -n <NAMESPACE> create secret generic ozone-s3-credentials --from-literal=aws_access_key_id="<AWS_ACCESS_KEY_ID>" --from-literal=aws_secret_access_key="<AWS_SECRET_ACCESS_KEY>"

Install or upgrade the chart with a values file versioned for your environment:

Terminal input

helm upgrade --install <RELEASE_NAME> oci://registry.tecnisys.com.br/tdp/charts/tdp-ozone -n <NAMESPACE> --create-namespace -f <VALUES_FILE>

OpenShift

On OpenShift, the chart requires additional permissions. Enable platform support at installation:

Terminal input

helm upgrade --install <RELEASE_NAME> oci://registry.tecnisys.com.br/tdp/charts/tdp-ozone -n <NAMESPACE> --create-namespace --set openshift.enabled=true -f <VALUES_FILE>

Validate the main resources:

Terminal input

kubectl -n <NAMESPACE> get pods,svc,ingress

Main parameters

Main parameters

Parameter	Description	Default
ozone.enabled	Enables the Ozone subchart	true
ozone.image.repository	Image used by Ozone services	apache/ozone
ozone.image.tag	Ozone image version	2.0.0
ozone.datanode.replicas	Number of datanodes	3
ozone.datanode.persistence.enabled	Enable Datanode persistence	false
ozone.om.replicas	Ozone Manager replicas	1
ozone.om.service.type	Ozone Manager service type	ClusterIP
ozone.scm.replicas	SCM replicas	1
ozone.scm.service.type	SCM service type	ClusterIP
ozone.s3g.replicas	S3 Gateway replicas	1
ozone.s3g.auth.enabled	Enables AWS Signature v4 authentication on the S3 Gateway	true
ozone.s3g.auth.secretName	Kubernetes Secret with aws_access_key_id and aws_secret_access_key	ozone-s3-credentials
ingress.om.enabled	Exposes the Ozone Manager UI through Ingress	true
ingress.om.hosts[0].host	Ingress hostname for the OM UI	ozone-om.tdp.local
ingress.scm.enabled	Exposes the SCM UI through Ingress	true
ingress.scm.hosts[0].host	Ingress hostname for the SCM UI	ozone-scm.tdp.local
ingress.s3g.web.enabled	Exposes the S3 Gateway Web UI through Ingress	true
ingress.s3g.web.hosts[0].host	Ingress hostname for the S3 Gateway Web UI	ozone-s3-ui.tdp.local
ingress.s3g.rest.enabled	Exposes the S3 REST API through Ingress	true
ingress.s3g.rest.hosts[0].host	Ingress hostname for the S3 REST API	ozone-s3.tdp.local
TDP-Settings.gateway.ingress.enabled	Enables chart Ingress resources	false
TDP-Settings.gateway.gatewayApi.enabled	Enables chart Gateway API resources	false

Configuration details

Persistence

By default, all services start without persistent volumes (persistence.enabled: false). In production, enable PVCs at least for the stateful components: Datanodes, OM, and SCM.

The configuration pattern is the same for each component — just enable it and set the desired size. The storageClassName field is optional: if omitted, the cluster uses its default StorageClass.

ozone:
  datanode:
    persistence:
      enabled: true
      size: 100Gi
      # storageClassName: "<STORAGE_CLASS>"  # optional
  om:
    persistence:
      enabled: true
      size: 10Gi
  scm:
    persistence:
      enabled: true
      size: 10Gi

Size datanodes according to expected lakehouse growth. OM and SCM usually need less space than object data, but they also require stable storage to preserve metadata and operational history.

Access & Security

Access

S3 Gateway REST

Inside the cluster, use the S3 Gateway REST Service:

http://<RELEASE_NAME>-s3g-rest.<NAMESPACE>.svc.cluster.local:9878

For local tests without Ingress, use port-forward:

Terminal input

kubectl -n <NAMESPACE> port-forward svc/<RELEASE_NAME>-s3g-rest 9878:9878

Then point S3 clients to http://127.0.0.1:9878.

Administrative interfaces

When Ingress is enabled, the web interfaces are accessible through the hostnames configured in ingress.*.hosts[0].host. The chart's default values are:

Interface	Default hostname
S3 Gateway Web UI	ozone-s3-ui.tdp.local
Ozone Manager UI	ozone-om.tdp.local
SCM UI	ozone-scm.tdp.local

Without Ingress, use port-forward. Service names are based on the Helm release name (<RELEASE_NAME>):

Interface	Service	Port
S3 Gateway Web UI	<RELEASE_NAME>-s3g-web	19878
Ozone Manager UI	<RELEASE_NAME>-om	9874
SCM UI	<RELEASE_NAME>-scm	9876

warning

When exposing Ozone outside the cluster, treat the S3 Gateway REST as a data API: require TLS, S3 authentication, correct DNS, and NetworkPolicy. Expose it only when external access is strictly necessary.

Troubleshooting

Troubleshooting

Symptom	Check	Action
Pods do not become ready	kubectl -n <NAMESPACE> get pods	Check events, resources, and pending PVCs
Services are missing	kubectl -n <NAMESPACE> get svc	Confirm the release name and namespace
S3 client cannot connect	kubectl -n <NAMESPACE> get endpoints <RELEASE_NAME>-s3g-rest	Validate internal DNS, port 9878, and NetworkPolicy
S3 authentication error	kubectl -n <NAMESPACE> get secret ozone-s3-credentials	Check the Secret and the credentials used by the client
Ingress does not respond	kubectl -n <NAMESPACE> get ingress	Review ingressClassName, DNS, and TLS for the published hostname

Uninstallation

Uninstallation

Terminal input

helm uninstall <RELEASE_NAME> -n <NAMESPACE>