Bug 2004003
| Summary: | [External Mode] rook TLS certificate was not created | ||
|---|---|---|---|
| Product: | [Red Hat Storage] Red Hat OpenShift Data Foundation | Reporter: | Vijay Avuthu <vavuthu> |
| Component: | ocs-operator | Assignee: | arun kumar mohan <amohan> |
| Status: | CLOSED ERRATA | QA Contact: | Anna Sandler <asandler> |
| Severity: | urgent | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 4.9 | CC: | amohan, asandler, jarrpa, jijoy, madam, mbukatov, muagarwa, ocs-bugs, odf-bz-bot, shan, sostapov |
| Target Milestone: | --- | Keywords: | Automation |
| Target Release: | ODF 4.9.0 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | v4.9.0-158.ci | Doc Type: | No Doc Update |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-12-13 17:46:17 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Vijay Avuthu
2021-09-14 09:58:57 UTC
Please share the JSON output of the external script. Vijay, did you use the new flag `--rgw-tls-cert-path`, it looks like the cert is missing from the output. The ObjectStore CR specifies:
securePort: 8080
sslCertificateRef: ceph-rgw-tls-cert
This means a secure connection is in place and thus a certificate is used.
Typically for rgw to run with TLS, the certificate is located in /etc/ceph/private/rgw-cert.pem
I don't see any bug here, just a misconfiguration. If you agree please close this BZ.
Thanks.
It looks like ocs-op is setting SecurePort in the CephObjectStore CR but the external is not using TLS. ocs-op should check the presence of a Secret call "ceph-rgw-tls-cert" and then turn on TLS if needed. Arun PTAL clearing needinfo based on comment #8 Taking the BZ. Will update. A minor fix, PR: https://github.com/red-hat-storage/ocs-operator/pull/1346 is up Jose please take a look [asandler@fedora ~]$ oc get csv No resources found in default namespace. [asandler@fedora ~]$ oc get csv -A \NAMESPACE NAME DISPLAY VERSION REPLACES PHASE openshift-operator-lifecycle-manager packageserver Package Server 0.18.3 Succeeded openshift-storage noobaa-operator.v4.9.0-158.ci NooBaa Operator 4.9.0-158.ci Succeeded openshift-storage ocs-operator.v4.9.0-158.ci OpenShift Container Storage 4.9.0-158.ci Succeeded openshift-storage odf-operator.v4.9.0-158.ci OpenShift Data Foundation 4.9.0-158.ci Succeeded [asandler@fedora ~]$ oc -n openshift-storage get backingstore NAME TYPE PHASE AGE noobaa-default-backing-store aws-s3 Ready 167m Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: Red Hat OpenShift Data Foundation 4.9.0 enhancement, security, and bug fix update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2021:5086 |