unkin/puppet-prod
3
0
Fork 0
Code Issues 10 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

ceph/rgw: add s3.ceph.unkin.net to radosgw cert SAN + nginx aliases
ci/woodpecker/pr/ruby-validate Pipeline was successful
Details
ci/woodpecker/pr/yamllint Pipeline was successful
Details
ci/woodpecker/pr/bolt-validate Pipeline was successful
Details
ci/woodpecker/pr/puppet-lint Pipeline was successful
Details
ci/woodpecker/pr/erb-validate Pipeline was successful
Details
ci/woodpecker/pr/epp-validate Pipeline was successful
Details
ci/woodpecker/pr/puppet-validate Pipeline was successful
Details
ci/woodpecker/pr/ruby-check Pipeline was successful
Details

Browse Source 
s3.ceph.unkin.net is the S3 endpoint name (a CNAME to radosgw.service.consul).
The radosgw hosts front RGW with nginx (443 -> radosgw:7480) using the vault
cert, so both the cert and nginx must recognise the name.

- Add s3.ceph.unkin.net to profiles::pki::vault::alt_names (cert SAN).
- Add s3.ceph.unkin.net to profiles::nginx::simpleproxy::nginx_aliases so
  nginx answers for it.
This commit is contained in:
benvin
2026-07-18 16:29:02 +10:00
parent 8f49c35c16
commit c88e7dd314
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hieradata/roles/infra/ceph/rgw.yaml
+5
View File
@@ -14,6 +14,9 @@ profiles::pki::vault::alt_names:
- radosgw.service.consul - radosgw.service.consul
- radosgw.query.consul - radosgw.query.consul
- "radosgw.service.%{facts.country}-%{facts.region}.consul" - "radosgw.service.%{facts.country}-%{facts.region}.consul"
# S3 endpoint name (s3.ceph.unkin.net CNAME -> radosgw.service.consul); needed
# on the cert so TLS validates for that hostname.
- s3.ceph.unkin.net
# additional repos # additional repos
profiles::yum::global::repos: profiles::yum::global::repos:
@@ -26,6 +29,8 @@ profiles::yum::global::repos:
profiles::nginx::simpleproxy::nginx_vhost: 'radosgw.service.consul' profiles::nginx::simpleproxy::nginx_vhost: 'radosgw.service.consul'
profiles::nginx::simpleproxy::nginx_aliases: profiles::nginx::simpleproxy::nginx_aliases:
- radosgw.service.au-syd1.consul - radosgw.service.au-syd1.consul
# nginx (443 -> radosgw:7480) must answer for the S3 endpoint name too.
- s3.ceph.unkin.net
profiles::nginx::simpleproxy::proxy_port: 7480 profiles::nginx::simpleproxy::proxy_port: 7480
profiles::nginx::simpleproxy::proxy_path: '/' profiles::nginx::simpleproxy::proxy_path: '/'
nginx::client_max_body_size: 5000M nginx::client_max_body_size: 5000M