From 732c938c5aa4faf5d35f7ddc4c2c1029eb8ea52b Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sat, 18 Jul 2026 17:01:41 +1000 Subject: [PATCH] ceph/rgw: add s3.ceph.unkin.net to radosgw cert SAN + nginx aliases (#487) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Why `s3.ceph.unkin.net` is the RGW S3 endpoint name used by cephrgw-operator consumers. A companion argocd-apps PR adds it as a CNAME to `radosgw.service.consul`. The radosgw hosts front RGW with nginx (443 -> radosgw:7480) using the vault-issued cert, so **both** the certificate and nginx must recognise the name. ## Changes (hieradata/roles/infra/ceph/rgw.yaml) - Add `s3.ceph.unkin.net` to `profiles::pki::vault::alt_names` — puts the name in the radosgw cert SAN (renewal re-triggers on the alt-names change). - Add `s3.ceph.unkin.net` to `profiles::nginx::simpleproxy::nginx_aliases` — nginx answers for that server_name. ### nginx: yes, needed radosgw sits behind `profiles::nginx::simpleproxy` (listens 443, proxies to :7480) sharing the same vault cert, so the alias is required for nginx to serve the hostname — not just the cert SAN. --------- Co-authored-by: benvin Reviewed-on: https://git.unkin.net/unkin/puppet-prod/pulls/487 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- hieradata/roles/infra/ceph/rgw.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/hieradata/roles/infra/ceph/rgw.yaml b/hieradata/roles/infra/ceph/rgw.yaml index 7b65271..75163f1 100644 --- a/hieradata/roles/infra/ceph/rgw.yaml +++ b/hieradata/roles/infra/ceph/rgw.yaml @@ -14,6 +14,9 @@ profiles::pki::vault::alt_names: - radosgw.service.consul - radosgw.query.consul - "radosgw.service.%{facts.country}-%{facts.region}.consul" + # S3 endpoint name (s3.ceph.unkin.net CNAME -> radosgw.service.consul); needed + # on the cert so TLS validates for that hostname. + - s3.ceph.unkin.net # additional repos profiles::yum::global::repos: @@ -26,6 +29,8 @@ profiles::yum::global::repos: profiles::nginx::simpleproxy::nginx_vhost: 'radosgw.service.consul' profiles::nginx::simpleproxy::nginx_aliases: - radosgw.service.au-syd1.consul + # nginx (443 -> radosgw:7480) must answer for the S3 endpoint name too. + - s3.ceph.unkin.net profiles::nginx::simpleproxy::proxy_port: 7480 profiles::nginx::simpleproxy::proxy_path: '/' nginx::client_max_body_size: 5000M