Zonegroups and the shape of multisite

Expert⏱ ~18 minradosgw-admin

What you'll learn

Explain the zonegroup's role in replication
Distinguish the common multisite topologies
Identify what replicates and what does not
Choose a topology for a stated requirement

Prerequisites

None — start here.

Verified against Ceph Tentacle 20.2.x · Ceph Squid 19.2.x (supported previous) · cephadm matches the verified Ceph release · podman 4.x · csi-rbd and csi-cephfs current · RBD / CephFS / RGW current (matches Ceph release) · Linux kernel 5.15+ (5.10 minimum) · Ubuntu 24.04 LTS (Ceph host baseline) · Debian 12 (Bookworm) (Ceph host baseline) · Rocky Linux / RHEL / AlmaLinux 9.x (Ceph host baseline) · Proxmox VE 9.x (cross-course integration) · Kubernetes 1.31+ (cross-course integration) · 2026-08-18

Why this matters in production

Multisite is where most RGW complexity lives, and the topologies solve genuinely different problems. Choosing on the basis of what replicates — metadata, data, or both — rather than on geography is what makes the choice correct.

What replicates where

Scope	Replicated across
Realm metadata (realms, zonegroups, zones)	everything in the realm
User and bucket metadata	all zones in a zonegroup
Object data	zones in a zonegroup, if data sync is enabled

The critical distinction: metadata replicates across a zonegroup; object data replicates only where data sync is configured. Two zones in one zonegroup share the user and bucket namespace by default, which is what makes a single global namespace possible.

The topologies

Active-active within a zonegroup. Two or more zones, both accepting writes, replicating data both ways.

radosgw-admin zone create --rgw-zonegroup=global --rgw-zone=site-b \
    --endpoints=https://rgw-b.example.com \
    --access-key=$SYS_KEY --secret=$SYS_SECRET
radosgw-admin period update --commit

Provides: disaster recovery, and reads served locally at each site. Costs: replication lag, and conflicting concurrent writes to the same key resolve last-writer-wins.

Active-passive. One zone accepts writes, another replicates and serves reads.

Provides: a clean disaster recovery target with no write conflicts. Costs: the passive site’s capacity is idle for writes.

Separate zonegroups, one realm. Zones in different zonegroups share metadata but not data.

Provides: a single user and bucket namespace across regions, with data staying where it was written. This is how “buckets are global, data is regional” is implemented.

Archive zone. A zone that replicates in and retains every version.

radosgw-admin zone modify --rgw-zone=archive --tier-type=archive

Provides: protection against deletion and overwrite propagating, which ordinary replication does not.

Choosing

Requirement	Topology
Survive site loss with no data loss	active-passive or active-active
Serve reads locally at multiple sites	active-active
One namespace, data stays regional	separate zonegroups in one realm
Protect against replicated deletion	archive zone
Lowest complexity	single zone

Monitoring replication

radosgw-admin sync status
radosgw-admin data sync status --source-zone=site-a
radosgw-admin metadata sync status
radosgw-admin bucket sync status --bucket=data

sync status is the command to have in the runbook — it reports how far behind each zone is and whether sync is progressing.

Quiz

Knowledge check · 4 questions

Q1. Two zones are in the same zonegroup with data sync disabled. What is shared between them?

Nothing — zones share configuration only when data sync is enabled between them Object data but not metadata, so each zone keeps its own user and bucket records Everything, since zonegroup membership implies full replication of metadata and data User and bucket metadata — so the namespace is shared — but not object data
Q2. Multisite replication copies a deletion to the other site as faithfully as it copies a write.

True False
Q3. Choose a multisite topology for a stated requirement.

An organisation has data centres in two countries. Regulation requires that data written in each country remains in that country. They want users to have one set of credentials and one bucket namespace across both.
Q4. Why are metadata sync and data sync separate mechanisms?

Passing score: 75%. Answers are checked in this browser.

Production discipline

Choose a multisite topology from what must and must not replicate rather than from geography; the metadata-versus-data distinction is what makes regulatory requirements expressible. Keep radosgw-admin sync status in the runbook and monitor metadata and data sync separately, since one can be current while the other lags badly.

Cross-course references

Kubernetes: federated control plane with local data planes is the same separation
Linux: replicating configuration without replicating state is a recurring distributed-systems pattern