unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Trust internal CA in cephrgw-operator (fix radosgw TLS) #276

Merged
benvin merged 1 commits from benvin/cephrgw-operator-vault-ca into main 2026-07-24 23:25:03 +10:00
Conversation 0 Commits 1 Files Changed 1
+15
unkinben commented 2026-07-24 23:23:42 +10:00
Owner
Copy Link
Copy Source

Why

cephrgw-operator v0.2.0 talks to radosgw over HTTPS (radosgw.service.consul:443, fronted by nginx presenting the internal unkin.net Vault-PKI cert). With no CA configured the operator fails:

Get "https://radosgw.service.consul:443/admin/user?...": tls: failed to verify certificate: x509: certificate signed by unknown authority

The vault-ca-cert Secret (the unkin.net intermediate+root) is already reflected into every namespace — including cephrgw-system — so the fix is deployment-only.

Changes

  • mount the vault-ca-cert Secret (key ca.crt) read-only at /etc/vault-ca/ca.crt, following the puppet/artifactapi pattern
  • set CEPH_RGW_CA_FILE=/etc/vault-ca/ca.crt so the operator adds the CA to its TLS trust

No image change (still v0.2.0); reloader + a normal reconcile pick it up. Validated with kustomize build on the au-syd1 overlay.

https://claude.ai/code/session_016CEncETbf8cvy1PhsHfFHM

## Why cephrgw-operator v0.2.0 talks to radosgw over HTTPS (`radosgw.service.consul:443`, fronted by nginx presenting the internal `unkin.net` Vault-PKI cert). With no CA configured the operator fails: ``` Get "https://radosgw.service.consul:443/admin/user?...": tls: failed to verify certificate: x509: certificate signed by unknown authority ``` The `vault-ca-cert` Secret (the `unkin.net` intermediate+root) is already reflected into every namespace — including `cephrgw-system` — so the fix is deployment-only. ## Changes - mount the `vault-ca-cert` Secret (key `ca.crt`) read-only at `/etc/vault-ca/ca.crt`, following the puppet/artifactapi pattern - set `CEPH_RGW_CA_FILE=/etc/vault-ca/ca.crt` so the operator adds the CA to its TLS trust No image change (still `v0.2.0`); `reloader` + a normal reconcile pick it up. Validated with `kustomize build` on the au-syd1 overlay. https://claude.ai/code/session_016CEncETbf8cvy1PhsHfFHM
unkinben added 1 commit 2026-07-24 23:23:43 +10:00
Trust internal CA in cephrgw-operator (fix radosgw TLS)
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
505e6f4cf8 
cephrgw-operator v0.2.0 talks to radosgw over HTTPS
(radosgw.service.consul:443, fronted by nginx with the internal unkin.net
Vault-PKI cert). With no CA configured it fails with x509 "certificate signed
by unknown authority". Mount the reflected vault-ca-cert and point the operator
at it.

- mount the vault-ca-cert Secret (key ca.crt) read-only at
  /etc/vault-ca/ca.crt, following the puppet/artifactapi pattern
- set CEPH_RGW_CA_FILE to that path so the operator adds the CA to its trust

Claude-Session: https://claude.ai/code/session_016CEncETbf8cvy1PhsHfFHM
benvin merged commit 4580a5f6a4 into main 2026-07-24 23:25:03 +10:00
benvin deleted branch benvin/cephrgw-operator-vault-ca 2026-07-24 23:25:04 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#276
Delete Branch "benvin/cephrgw-operator-vault-ca"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?