cephrgw-operator v0.2.0 talks to radosgw over HTTPS
(radosgw.service.consul:443, fronted by nginx with the internal unkin.net
Vault-PKI cert). With no CA configured it fails with x509 "certificate signed
by unknown authority". Mount the reflected vault-ca-cert and point the operator
at it.
- mount the vault-ca-cert Secret (key ca.crt) read-only at
/etc/vault-ca/ca.crt, following the puppet/artifactapi pattern
- set CEPH_RGW_CA_FILE to that path so the operator adds the CA to its trust
Claude-Session: https://claude.ai/code/session_016CEncETbf8cvy1PhsHfFHM
unkinben