unkin/puppet-prod
3
0
Fork 0
Code Issues 10 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

ceph/rgw: add s3.ceph.unkin.net to radosgw cert SAN + nginx aliases #487

Merged
benvin merged 1 commits from benvin/rgw-s3-altname into develop 2026-07-18 17:01:41 +10:00
Conversation 0 Commits 1 Files Changed 1
+5
unkinben commented 2026-07-18 16:29:22 +10:00
Owner
Copy Link
Copy Source

Why

s3.ceph.unkin.net is the RGW S3 endpoint name used by cephrgw-operator consumers. A companion argocd-apps PR adds it as a CNAME to radosgw.service.consul. The radosgw hosts front RGW with nginx (443 -> radosgw:7480) using the vault-issued cert, so both the certificate and nginx must recognise the name.

Changes (hieradata/roles/infra/ceph/rgw.yaml)

  • Add s3.ceph.unkin.net to profiles::pki::vault::alt_names — puts the name in the radosgw cert SAN (renewal re-triggers on the alt-names change).
  • Add s3.ceph.unkin.net to profiles::nginx::simpleproxy::nginx_aliases — nginx answers for that server_name.

nginx: yes, needed

radosgw sits behind profiles::nginx::simpleproxy (listens 443, proxies to :7480) sharing the same vault cert, so the alias is required for nginx to serve the hostname — not just the cert SAN.

## Why `s3.ceph.unkin.net` is the RGW S3 endpoint name used by cephrgw-operator consumers. A companion argocd-apps PR adds it as a CNAME to `radosgw.service.consul`. The radosgw hosts front RGW with nginx (443 -> radosgw:7480) using the vault-issued cert, so **both** the certificate and nginx must recognise the name. ## Changes (hieradata/roles/infra/ceph/rgw.yaml) - Add `s3.ceph.unkin.net` to `profiles::pki::vault::alt_names` — puts the name in the radosgw cert SAN (renewal re-triggers on the alt-names change). - Add `s3.ceph.unkin.net` to `profiles::nginx::simpleproxy::nginx_aliases` — nginx answers for that server_name. ### nginx: yes, needed radosgw sits behind `profiles::nginx::simpleproxy` (listens 443, proxies to :7480) sharing the same vault cert, so the alias is required for nginx to serve the hostname — not just the cert SAN.
unkinben added 1 commit 2026-07-18 16:29:22 +10:00
ceph/rgw: add s3.ceph.unkin.net to radosgw cert SAN + nginx aliases
ci/woodpecker/pr/ruby-validate Pipeline was successful
Details
ci/woodpecker/pr/yamllint Pipeline was successful
Details
ci/woodpecker/pr/bolt-validate Pipeline was successful
Details
ci/woodpecker/pr/puppet-lint Pipeline was successful
Details
ci/woodpecker/pr/erb-validate Pipeline was successful
Details
ci/woodpecker/pr/epp-validate Pipeline was successful
Details
ci/woodpecker/pr/puppet-validate Pipeline was successful
Details
ci/woodpecker/pr/ruby-check Pipeline was successful
Details
c88e7dd314 
s3.ceph.unkin.net is the S3 endpoint name (a CNAME to radosgw.service.consul).
The radosgw hosts front RGW with nginx (443 -> radosgw:7480) using the vault
cert, so both the cert and nginx must recognise the name.

- Add s3.ceph.unkin.net to profiles::pki::vault::alt_names (cert SAN).
- Add s3.ceph.unkin.net to profiles::nginx::simpleproxy::nginx_aliases so
  nginx answers for it.
benvin merged commit 732c938c5a into develop 2026-07-18 17:01:41 +10:00
benvin deleted branch benvin/rgw-s3-altname 2026-07-18 17:01:41 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/puppet-prod#487
Delete Branch "benvin/rgw-s3-altname"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?