How To Change The Owner Of Prometheus Bucket Stored In Rook-ceph

[system]

How to change the owner of a bucket stored in rook-ceph

Issue Description:

After upgrading from 23.10.3 to 24.10.3, the thanos-objectstore-config secret was missing because the thanos-init application had not been synced. As a result, the create-ceph-thanos-secret-job could not run and was failing with the following error:

'time="2025-08-11T13:52:30Z" level=info msg="Creating S3 bucket: \"prometheus\"'

time="2025-08-11T13:52:30Z" level=info msg="Received error code \"BucketAlreadyExists\" with message Cannot modify existing access control policy'

Error: 'failure while creating bucket 'prometheus': cannot create bucket "prometheus": BucketAlreadyExists: Cannot modify existing access control policy

status code: 409, request id: tx000000327cbfdc6e3f4a9-006899f59e-11375219-rook-ceph, host id:'

Resolution:

kubectl -n rook-ceph exec -it rook-ceph-tools-replace-with-yours -- bash

Check the owner of the bucket using the following command:

radosgw-admin bucket stats --bucket="prometheus"

radosgw-admin --bucket="prometheus" policy

If it's 'admin', change the owner of the bucket from 'admin' to 'thanos':

radosgw-admin bucket chown --bucket="prometheus" --uid="thanos"

radosgw-admin bucket link --uid=thanos --bucket=prometheus

then re-check using:

radosgw-admin bucket stats --bucket="prometheus"

radosgw-admin --bucket="prometheus" policy

Finally, re-sync thanos-init from ArgoCD and the job should run successfully and create the secret.