unkinben
732c938c5a
## Why `s3.ceph.unkin.net` is the RGW S3 endpoint name used by cephrgw-operator consumers. A companion argocd-apps PR adds it as a CNAME to `radosgw.service.consul`. The radosgw hosts front RGW with nginx (443 -> radosgw:7480) using the vault-issued cert, so **both** the certificate and nginx must recognise the name. ## Changes (hieradata/roles/infra/ceph/rgw.yaml) - Add `s3.ceph.unkin.net` to `profiles::pki::vault::alt_names` — puts the name in the radosgw cert SAN (renewal re-triggers on the alt-names change). - Add `s3.ceph.unkin.net` to `profiles::nginx::simpleproxy::nginx_aliases` — nginx answers for that server_name. ### nginx: yes, needed radosgw sits behind `profiles::nginx::simpleproxy` (listens 443, proxies to :7480) sharing the same vault cert, so the alias is required for nginx to serve the hostname — not just the cert SAN. --------- Co-authored-by: benvin <neotheo@gmail.com> Reviewed-on: #487 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
56 lines
1.5 KiB
YAML
56 lines
1.5 KiB
YAML
---
|
|
hiera_include:
|
|
- profiles::ceph::rgw
|
|
- profiles::nginx::simpleproxy
|
|
|
|
profiles::ceph::rgw::enable: true
|
|
|
|
# FIXME: puppet-python wants to try manage python-dev, which is required by the ceph package
|
|
python::manage_dev_package: false
|
|
|
|
# additional altnames
|
|
profiles::pki::vault::alt_names:
|
|
- radosgw.main.unkin.net
|
|
- radosgw.service.consul
|
|
- radosgw.query.consul
|
|
- "radosgw.service.%{facts.country}-%{facts.region}.consul"
|
|
# S3 endpoint name (s3.ceph.unkin.net CNAME -> radosgw.service.consul); needed
|
|
# on the cert so TLS validates for that hostname.
|
|
- s3.ceph.unkin.net
|
|
|
|
# additional repos
|
|
profiles::yum::global::repos:
|
|
ceph:
|
|
ensure: present
|
|
ceph-noarch:
|
|
ensure: present
|
|
|
|
# manage a simple nginx reverse proxy
|
|
profiles::nginx::simpleproxy::nginx_vhost: 'radosgw.service.consul'
|
|
profiles::nginx::simpleproxy::nginx_aliases:
|
|
- radosgw.service.au-syd1.consul
|
|
# nginx (443 -> radosgw:7480) must answer for the S3 endpoint name too.
|
|
- s3.ceph.unkin.net
|
|
profiles::nginx::simpleproxy::proxy_port: 7480
|
|
profiles::nginx::simpleproxy::proxy_path: '/'
|
|
nginx::client_max_body_size: 5000M
|
|
|
|
# manage consul service
|
|
consul::services:
|
|
radosgw:
|
|
service_name: 'radosgw'
|
|
address: "%{facts.networking.ip}"
|
|
port: 443
|
|
checks:
|
|
- id: 'radosgw_https_check'
|
|
name: 'RADOSGW HTTPS Check'
|
|
http: "https://%{facts.networking.fqdn}:443"
|
|
method: 'GET'
|
|
tls_skip_verify: true
|
|
interval: '10s'
|
|
timeout: '1s'
|
|
profiles::consul::client::node_rules:
|
|
- resource: service
|
|
segment: radosgw
|
|
disposition: write
|