From 24bd846c4d0c1aa841edc279371a5c3b603de485 Mon Sep 17 00:00:00 2001 From: Jack Hodgkiss Date: Mon, 1 Jun 2026 12:22:57 +0100 Subject: [PATCH] docs: support mounting `ca-bundle.crt` in `ceph` Services such as RGW integration with `keystone` have in the past required ignoring `SSL` verification failures. This can be avoided by mounting the `ca-bundle.crt` in the container for a more secure deployment. Signed-off-by: Jack Hodgkiss --- doc/source/configuration/cephadm.rst | 33 +++++++++++++++++++++++++++- 1 file changed, 32 insertions(+), 1 deletion(-) diff --git a/doc/source/configuration/cephadm.rst b/doc/source/configuration/cephadm.rst index 09dcd2075b..6f73bfc05d 100644 --- a/doc/source/configuration/cephadm.rst +++ b/doc/source/configuration/cephadm.rst @@ -410,7 +410,7 @@ The set of commands below configure all of these. - "config set client.rgw rgw_keystone_api_version '3'" - "config set client.rgw rgw_keystone_token_cache_size '10000'" - "config set client.rgw rgw_keystone_url {{ 'https' if kolla_enable_tls_internal | bool else 'http' }}://{{ kolla_internal_fqdn }}:5000" - - "config set client.rgw rgw_keystone_verify_ssl false" + - "config set client.rgw rgw_keystone_verify_ssl true" - "config set client.rgw rgw_max_attr_name_len '1000'" - "config set client.rgw rgw_max_attr_size '1000'" - "config set client.rgw rgw_max_attrs_num_in_req '1000'" @@ -418,6 +418,37 @@ The set of commands below configure all of these. - "config set client.rgw rgw_swift_account_in_url true" - "config set client.rgw rgw_swift_versioning_enabled true" +In order to allow for `rgw_keystone_verify_ssl` to be set to `true` the `CA` +used to create the internal certificate must be first copied to the `Ceph` +host using + +.. code:: bash + + kayobe playbook run $KAYOBE_CONFIG_PATH/ansible/deployment/copy-ca-to-hosts.yml + +and then mounted within all appropriate `Ceph` daemons which can be achieved by +adding the following to `cephadm.yml` + +.. code:: yaml + + ca_bundle_path: >- + {{ + '/etc/ssl/certs/ca-certificates.crt' + if os_distribution == 'ubuntu' + else '/etc/pki/tls/certs/ca-bundle.crt' + }} + + cephadm_extra_container_args: + - "-v" + - "{{ ca_bundle_path }}:/etc/pki/tls/certs/ca-bundle.crt:ro" + +then running `kayobe playbook run $KAYOBE_CONFIG_PATH/ansible/ceph/cephadm-deploy.yml` + +.. note:: + + If cluster already exists then run `kayobe playbook run $KAYOBE_CONFIG_PATH/ansible/ceph/cephadm-deploy.yml` + and follow up with `ceph orch redeploy SERVICE_NAME` inside a `cephadm shell` for all services. + Enable the Kolla Ansible RADOS Gateway integration in ``kolla.yml``: .. code:: yaml