From 505e6f4cf8e5b7df35f55c9f894154973c67f8ac Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Fri, 24 Jul 2026 23:23:41 +1000 Subject: [PATCH] Trust internal CA in cephrgw-operator (fix radosgw TLS) cephrgw-operator v0.2.0 talks to radosgw over HTTPS (radosgw.service.consul:443, fronted by nginx with the internal unkin.net Vault-PKI cert). With no CA configured it fails with x509 "certificate signed by unknown authority". Mount the reflected vault-ca-cert and point the operator at it. - mount the vault-ca-cert Secret (key ca.crt) read-only at /etc/vault-ca/ca.crt, following the puppet/artifactapi pattern - set CEPH_RGW_CA_FILE to that path so the operator adds the CA to its trust Claude-Session: https://claude.ai/code/session_016CEncETbf8cvy1PhsHfFHM --- apps/base/cephrgw-system/deployment.yaml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/apps/base/cephrgw-system/deployment.yaml b/apps/base/cephrgw-system/deployment.yaml index 3ccfbfa..6f99a79 100644 --- a/apps/base/cephrgw-system/deployment.yaml +++ b/apps/base/cephrgw-system/deployment.yaml @@ -36,6 +36,17 @@ spec: # Vault per docs/ceph-setup.md; not managed in GitOps. - secretRef: name: cephrgw-credentials + env: + # Trust the internal unkin.net (Vault PKI) CA so the operator can + # verify radosgw's TLS cert. vault-ca-cert is reflected into every + # namespace from the certificates namespace. + - name: CEPH_RGW_CA_FILE + value: /etc/vault-ca/ca.crt + volumeMounts: + - name: vault-ca-cert + mountPath: /etc/vault-ca/ca.crt + subPath: ca.crt + readOnly: true ports: - containerPort: 8080 name: metrics @@ -65,3 +76,7 @@ spec: limits: cpu: 500m memory: 256Mi + volumes: + - name: vault-ca-cert + secret: + secretName: vault-ca-cert -- 2.47.3