From 4580a5f6a41d64c9979009a7cbf7181409a7bfe9 Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Fri, 24 Jul 2026 23:25:03 +1000
Subject: [PATCH] Trust internal CA in cephrgw-operator (fix radosgw TLS)
 (#276)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Why

cephrgw-operator v0.2.0 talks to radosgw over HTTPS (`radosgw.service.consul:443`, fronted by nginx presenting the internal `unkin.net` Vault-PKI cert). With no CA configured the operator fails:

```
Get "https://radosgw.service.consul:443/admin/user?...": tls: failed to verify certificate: x509: certificate signed by unknown authority
```

The `vault-ca-cert` Secret (the `unkin.net` intermediate+root) is already reflected into every namespace — including `cephrgw-system` — so the fix is deployment-only.

## Changes

- mount the `vault-ca-cert` Secret (key `ca.crt`) read-only at `/etc/vault-ca/ca.crt`, following the puppet/artifactapi pattern
- set `CEPH_RGW_CA_FILE=/etc/vault-ca/ca.crt` so the operator adds the CA to its TLS trust

No image change (still `v0.2.0`); `reloader` + a normal reconcile pick it up. Validated with `kustomize build` on the au-syd1 overlay.

https://claude.ai/code/session_016CEncETbf8cvy1PhsHfFHM
Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/276
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>
---
 apps/base/cephrgw-system/deployment.yaml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/apps/base/cephrgw-system/deployment.yaml b/apps/base/cephrgw-system/deployment.yaml
index 3ccfbfa..6f99a79 100644
--- a/apps/base/cephrgw-system/deployment.yaml
+++ b/apps/base/cephrgw-system/deployment.yaml
@@ -36,6 +36,17 @@ spec:
             # Vault per docs/ceph-setup.md; not managed in GitOps.
             - secretRef:
                 name: cephrgw-credentials
+          env:
+            # Trust the internal unkin.net (Vault PKI) CA so the operator can
+            # verify radosgw's TLS cert. vault-ca-cert is reflected into every
+            # namespace from the certificates namespace.
+            - name: CEPH_RGW_CA_FILE
+              value: /etc/vault-ca/ca.crt
+          volumeMounts:
+            - name: vault-ca-cert
+              mountPath: /etc/vault-ca/ca.crt
+              subPath: ca.crt
+              readOnly: true
           ports:
             - containerPort: 8080
               name: metrics
@@ -65,3 +76,7 @@ spec:
             limits:
               cpu: 500m
               memory: 256Mi
+      volumes:
+        - name: vault-ca-cert
+          secret:
+            secretName: vault-ca-cert