Ceph RGW: Object Storage Ledger 2026 Scorecard

Part of the Object Storage Ledger (edition 2026-10-16). How the scores work: methodology.

Snapshot

Type: engine (open source; packaged by IBM Storage Ceph, Red Hat OpenShift Data Foundation, Rook, SUSE, Canonical, croit, 45Drives and others)
Owner: No single owner. The Ceph Foundation is a directed fund under the Linux Foundation since 2018-11-12; IBM took over Red Hat's Ceph team and premier Foundation sponsorship with a 2023-01-01 target
Licence: LGPL 2.1 and 3 mix with component exceptions (GitHub reports "Other"; licence file not read); free, no editions, no licence change found since 2023
Latest release: Tentacle 20.2.4 (2026-08-19); Squid 19.2.7 (2026-10-12); Tentacle 20.2.0 shipped 2025-11-18
Support lifecycle: About two years per stable series, two series supported at once: Reef ended 2026-03-20, Squid estimated end of life 2026-10-31, Tentacle estimated 2027-06-01; upgrading Pacific directly to Reef is no longer recommended
Next milestone: Next stable series (Umbrella, 21.x) in development; no GA date published
Object lock: S3 Object Lock in governance and compliance modes; since Tentacle 20.2.0 it can be enabled on existing versioned buckets (Ceph blog). Cohasset Associates assessed RGW Object Lock in October 2023, as cited by the Ceph project. No Veeam, Commvault, Rubrik or Proxmox Backup Server validation found for upstream RGW; validations belong to the products built on it
Tier: Open-source engine
Archetype: Dependable builder
Evidence grade: B. The release table, the Squid and Tentacle release notes, the RGW documentation index and the Ceph blog post on Object Lock were read from docs.ceph.com and ceph.io; release dates are grade A and the 2024 to 2026 features A or B. The CVE numbers of the 2026-08-19 releases and the Ceph Foundation date follow the Virtualization Storage Ledger's reading of the same Ceph pages. What shipped from Hammer to Quincy (2015 to 2022) is dated from the release table and described from general knowledge of the release notes, so those steps are grade C.

Scope of the scores: Scored as the upstream gateway alone, on what docs.ceph.com documents and the release notes say shipped. Durability and scale are those of the RADOS cluster under the gateway. Support contracts, FIPS builds, certifications and appliances belong to the products built on it and are scored under IBM Storage Ceph and Red Hat OpenShift Data Foundation.

Scorecard

Dimension	Score	Direction
Capability today	81.5 / 100	higher is better
Momentum since end of 2022	+6.6 points (2015 to 2022: +29.9)	higher is better
Credibility	18.5 / 25	higher is better
Commercial risk	not scored (engine: nothing to buy)
Technical lock-in	9.0 / 25	lower is better
Integrator fit	13.5 / 20	higher is better
AI leverage	3.5 / 20	higher is better
Ledger Index	66.3 / 100	balanced weights; see the methodology

Capability by domain, 2015 to today

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2015	2019	2022	Today
S3 API fidelity (15)	2.5	3.5	4	4.5
Immutability and compliance (12)	0	2.5	2.5	3.5
Durability and resilience (12)	3.5	4.5	5	5
Performance and scale (12)	3	4	4	4
Deployment freedom (10)	2.5	3.5	4	4
Security and multi-tenancy (10)	2	3	3	4
Operations (10)	2	3	3.5	3.5
Protocols beyond S3 (7)	3	3.5	3.5	4
Lifecycle and tiering (7)	0.5	3	3.5	3.5
Ecosystem and openness (5)	4	4.5	4.5	4.5
Total / 100	45.0	69.5	74.9	81.5

Year by year: 2015: 45.0 · 2016: 49.8 · 2017: 52.9 · 2018: 54.4 · 2019: 69.5 · 2020: 73.0 · 2021: 74.9 · 2022: 74.9 · 2023: 77.3 · 2024: 79.8 · 2025: 81.5 · 2026: 81.5

What moved the score

Year	Domain	Change	Points	Trigger
2016	Durability and resilience	3.5 → 4.5	+2.4	Jewel 10.2 (2016-04): multisite rewritten with active-active zones and per-bucket placement targets (grade C)
2016	Lifecycle and tiering	0.5 → 1.5	+1.4	Jewel: lifecycle expiration (grade C)
2016	Security and multi-tenancy	2 → 2.5	+1.0	Jewel: tenants for namespace isolation and LDAP authentication (grade C)
2017	Performance and scale	3 → 4	+2.4	Luminous 12.2 (2017-08): dynamic bucket index resharding, BlueStore default, device classes for placing index pools on flash (grade C); no S3 over RDMA and no independent benchmark found
2017	Protocols beyond S3	3 → 3.5	+0.7	Luminous era: NFS export of buckets through NFS-Ganesha; block (RBD) and file (CephFS) from the same cluster (grade C)
2018	Ecosystem and openness	4 → 4.5	+0.5	Ceph Foundation set up under the Linux Foundation (2018-11-12); packaged and resold by many vendors; no field-of-use or redistribution limits
2018	Operations	2 → 2.5	+1.0	Mimic: dashboard v2 (grade C)
2019	Deployment freedom	2.5 → 3.5	+2.0	Rook 1.0 operator manages object stores on Kubernetes (grade C)
2019	Immutability and compliance	0 → 2.5	+6.0	S3 Object Lock in governance and compliance modes from the Nautilus era; release unverified (grade C); no backup vendor validation
2019	Lifecycle and tiering	1.5 → 3	+2.1	Nautilus: storage classes with lifecycle transition between pools (grade C)
2019	Operations	2.5 → 3	+1.0	Nautilus: dashboard with RGW management and the Prometheus module (grade C)
2019	S3 API fidelity	2.5 → 3.5	+3.0	Nautilus 14.2 (2019-03-19): bucket policies, bucket notifications, lifecycle and SSE with an external KMS; years approximate (grade C)
2019	Security and multi-tenancy	2.5 → 3	+1.0	Nautilus era: IAM-style user policies, STS, SSE through Vault or Barbican, MFA delete; years approximate (grade C)
2020	Deployment freedom	3.5 → 4	+1.0	Octopus 15.2 (2020-03-23): cephadm deploys containerised daemons; any x86 or Arm server, air-gapped installs possible; the minimum footprint stays heavy for edge sites
2020	Operations	3 → 3.5	+1.0	Octopus: cephadm with automated rolling upgrades; published release lifecycle of about two years; Ansible and Terraform content is community-maintained and there is no support contract or fleet manager upstream
2020	S3 API fidelity	3.5 → 4	+1.5	Octopus 15.2 (2020-03-23): STS with web identity and S3 Select (grade C)
2021	Durability and resilience	4.5 → 5	+1.2	Pacific 16.2 (2021-03-31): stretch mode for two-site clusters beside bucket-level multisite sync policies (grade C for the release); no published rebuild tests
2021	Lifecycle and tiering	3 → 3.5	+0.7	Pacific: transition to a remote S3 cloud tier beside the cloud sync module; usage logs and quotas for chargeback (grade C); no tape tier
2023	Immutability and compliance	2.5 → 3.5	+2.4	Cohasset Associates assessment of RGW Object Lock (October 2023, cited by the Ceph project) gives independent compliance evidence; no backup vendor validation found for upstream RGW, so 3.5 and no higher
2024	S3 API fidelity	4 → 4.5	+1.5	Squid 19.2.0 (2024-09-26): User Accounts with AWS-compatible IAM APIs, topic policies for notifications, part-number GET; Tentacle 20.2.0 adds GetObjectAttributes; an S3 feature page is published on docs.ceph.com
2024	Security and multi-tenancy	3 → 3.5	+1.0	Squid 19.2.0 (2024-09-26): User Accounts with AWS-compatible IAM APIs
2025	Protocols beyond S3	3.5 → 4	+0.7	Tentacle 20.2.0: SMB manager module serves CephFS shares from the same cluster; S3 Vectors listed in the RGW docs with maturity not verified, so not counted; no Iceberg catalog, Azure Blob or GCS API
2025	Security and multi-tenancy	3.5 → 4	+1.0	Tentacle 20.2.0 (2025-11-18): tenant IAM deprecated in favour of User Accounts, single sign-on for the management gateway. Tentacle 20.2.4 and Squid 19.2.6 (2026-08-19) fix the CephX authentication bypass CVE-2025-30156 and CVE-2026-39944, a privilege escalation through RGW STS session tokens; every key must be renewed. No FIPS validation upstream, so 4 and no higher

Direction, 2023 to 2026

Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2023-08	Reef 18.2.0 GA (2023-08-07)	Packaging	C
2023-10	Cohasset Associates assessment of RGW Object Lock	Immutability	C
2024-09	Squid 19.2.0: RGW User Accounts with AWS-compatible IAM APIs	Security	C
2024-09	Squid 19.2.0: topic policies for bucket notifications, part-number GET	S3 API	C
2025-07	Squid 19.2.3: RGW STS authentication bypass CVE-2023-43040 fixed	Security	C
2025-11	Tentacle 20.2.0: Object Lock can be enabled on existing versioned buckets	Immutability	C
2025-11	Tentacle 20.2.0: GetObjectAttributes and faster bucket resharding	S3 API	C
2025-11	Tentacle 20.2.0: tenant-level IAM deprecated; STS Lite and sts:GetSessionToken to be removed no sooner than the V release	Security	V
2026-03	Reef reaches end of life on 2026-03-20	Packaging	U
2026-06	Tentacle 20.2.2: bucket full sync loop in multisite fixed	Durability	C
2026-08	Tentacle 20.2.3: CopyObject for encrypted objects fixed	S3 API	C
2026-08	Tentacle 20.2.4 and Squid 19.2.6: CephX bypass CVE-2025-30156 and RGW STS token CVE-2026-39944 fixed; all keys must be renewed	Security	C
2026-10	S3 Vectors listed in the RGW documentation; release and maturity not stated	AI	V
2026-10	Squid 19.2.7: backports only; Squid end of life estimated 2026-10-31	Packaging	U

Centre of gravity: Security (4), Packaging (3), S3 API (3)
Blind spots (no items): Performance, Deployment, Operations, Protocols, Lifecycle, Ecosystem, Licensing
Driver mix: Vision 14%, Customer need 71%, Market window 0%, Upstream 14%, Portfolio 0%
Idea-to-need index: 0.17 (0 = demand-pulled, 1 = thesis-pushed)

Credibility: 18.5 / 25

Criterion	Score	Basis
Cadence	3.5	One named release a year with dated point releases and published end-of-life dates; the named release has landed between August and November (Reef 2023-08-07, Squid 2024-09-26, Tentacle 2025-11-18)
Roadmap transparency	4	Open tracker, public release notes and documentation; no dated roadmap and no date for the next series
Say-do	4	Few promises; deprecations are announced a release ahead with a removal floor (STS Lite no sooner than V)
Velocity	3.5	Steady RGW additions: IAM accounts in Squid, GetObjectAttributes and lock on existing buckets in Tentacle
Lifecycle stability	3.5	About two years per series with two series supported; tenant IAM and STS Lite are being removed and Pacific cannot jump straight to Reef

Commercial risk: not scored

This is an engine: nobody sells it, so there are no commercial terms to score.

Technical lock-in: 9.0 / 25 (lower is better)

Criterion	Score	Basis
Formats	2.5	Objects are striped into RADOS objects on BlueStore and cannot be read as plain files without Ceph
Export path	1	S3 and Swift reads, multisite sync to another Ceph cluster, cloud sync module, rclone
Stack coupling	3	Needs a whole Ceph cluster with monitors and OSDs
Hardware / cloud coupling	0	Any x86 or Arm server, fully offline
Skills and tooling coupling	2.5	Ceph administration is a specialised and scarce skill; the tooling is open

Integrator fit: 13.5 / 20

Criterion	Score	Basis
Partner programme openness	4	Anyone may package, support and resell it; Ceph Foundation membership is open in tiers; no vendor programme with margins
Multi-tenancy and self-service	4	Tenants, User Accounts with IAM, user and bucket quotas, usage logs; no portal
API and infrastructure-as-code	3.5	Admin Ops API, Rook CRDs and cephadm; Terraform and Ansible content is community-maintained
Skills and certification	2	No vendor-neutral certification found; training comes from the packaging vendors

AI leverage: 3.5 / 20

How the product uses AI, scored per year like capability. Only GA counts.

Criterion	2019	2022	Today	Latest step
AI workload support	1	1	1.5	2026: S3 Vectors listed in the RGW documentation; release and maturity not verified, counted as half a step
AI platform stack	0	0	0	2015: None
AI-assisted operations	0	0	0	2015: None
Agent openness	2	2	2	2015: S3 and Admin Ops APIs that agents can drive; no MCP server found

Year by year: 2015: 3 · 2016: 3 · 2017: 3 · 2018: 3 · 2019: 3 · 2020: 3 · 2021: 3 · 2022: 3 · 2023: 3 · 2024: 3 · 2025: 3 · 2026: 3.5

AI say-do, 2023 to 2026: 1 AI items announced; 0 GA, 0 still preview, 1 pending, 0 dropped. S3 Vectors appears in the RGW documentation without a release or maturity statement; the project announced no other AI feature from 2023 to 2026.

Ceph RGW has no AI in its own operation; its AI role is as the object store under other platforms. S3 Vectors in the documentation is the only AI-specific item, and its release status is still open.

Reading

Ceph RGW has the highest capability score of the open-source engines because nearly every object feature a packaging vendor sells already exists upstream: active-active multisite, per-bucket placement, stretch mode, IAM accounts, Swift and cloud tiering. Immutability stays at 3.5 because no backup vendor has validated upstream RGW; the Cohasset assessment from 2023 is the strongest compliance evidence. Security stops at 4: there is no FIPS validation, and the 2026-08-19 releases fixed a CephX bypass and an STS token flaw that require every key to be renewed. A buyer running it without a vendor should check which stable series they run, because Squid reaches end of life around 2026-10-31, and who will patch the cluster and renew keys when the next advisory lands.

Open questions and items to re-score

The release that first shipped RGW Object Lock is unverified: the Squid 19.2.3 notes and the Ceph blog ("starting with Tentacle") differ on lock for existing buckets, and the Nautilus-era date is grade C.
Legal hold and bucket default retention were not confirmed in the RGW pages read.
No Veeam Ready, Commvault, Rubrik or Proxmox Backup Server validation was found for upstream RGW.
The exact SPDX licence terms; the licence file was not read.
Maturity and release of S3 Vectors in RGW.
Whether a date for the Umbrella (21.x) series has been published.
Capability steps for Hammer to Quincy (2015 to 2022) are grade C and should be re-read from the release notes.

	’16	’17	’18	’19	’20	’21	’23	’24	’25
S3 API fidelity				3	1			1
Immutability and compliance				1			1
Durability and resilience	1					1
Performance and scale		1
Deployment freedom					2
Security and multi-tenancy	3							2	1
Operations			1		3
Protocols beyond S3		2							2
Lifecycle and tiering	2			2		2
Ecosystem and openness			2