Skip to content

Add SSL configuration for RGW#355

Merged
UtkarshBhatthere merged 41 commits intocanonical:mainfrom
marceloneppel:rgw-https-support
Aug 20, 2024
Merged

Add SSL configuration for RGW#355
UtkarshBhatthere merged 41 commits intocanonical:mainfrom
marceloneppel:rgw-https-support

Conversation

@marceloneppel
Copy link
Member

@marceloneppel marceloneppel commented Jun 3, 2024

Description

Some tools, like pgBackRest, can currently only interact with S3-compatible storages if they work with SSL/TLS. This PR adds the possibility of enabling RadosGW with SSL/TLS enabled.

The main idea is to use the PostgreSQL charms with MicroCeph so users can do backups through pgBackRest in bucket without a cloud service subscription.

Type of change

  • New feature (non-breaking change which adds functionality)

How Has This Been Tested?

To test, I used the following steps:

  1. Generate some SSL files:
sudo openssl genrsa -out /var/snap/microceph/common/ca.key 2048
sudo openssl req -x509 -new -nodes -key /var/snap/microceph/common/ca.key -days 1024 -out /var/snap/microceph/common/ca.crt -outform PEM
sudo openssl genrsa -out /var/snap/microceph/common/server.key 2048
sudo openssl req -new -key /var/snap/microceph/common/server.key -out /var/snap/microceph/common/server.csr
sudo nano /var/snap/microceph/common/extfile.cnf # and put the following content: subjectAltName = DNS:localhost
sudo openssl x509 -req -in /var/snap/microceph/common/server.csr -CA /var/snap/microceph/common/ca.crt -CAkey /var/snap/microceph/common/ca.key -CAcreateserial -out /var/snap/microceph/common/server.crt -days 365 -extfile /var/snap/microceph/common/extfile.cnf
  1. Then bootstrap the MicroCeph cluster, enable the RadosGW service with SSL enabled and create a user:
sudo microceph cluster bootstrap
sudo microceph disk add loop,4G,3
sudo microceph enable rgw --ssl-certificate=/var/snap/microceph/common/server.crt --ssl-private-key=/var/snap/microceph/common/server.key
sudo microceph.radosgw-admin user create --uid test --display-name test
  1. To finish, test the access by creating a bucket:
aws configure # to configure the credentials from RadosGW.
AWS_CA_BUNDLE=/var/snap/microceph/common/ca.crt aws --endpoint-url=https://localhost s3 mb s3://test --region ""

Contributor's Checklist

Please check that you have:

  • self-reviewed the code in this PR.
  • added code comments, particularly in hard-to-understand areas.
  • updated the user documentation with corresponding changes.
  • added tests to verify effectiveness of this change.

Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
Copy link
Contributor

@UtkarshBhatthere UtkarshBhatthere left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

one nit, overall LGTM

Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
Copy link
Collaborator

@sabaini sabaini left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey @marceloneppel thanks for this welcome contribution!

I'm wondering about two things regarding parametrization.

One is relatively minor thing, aiui with SSL key material present we'd configure both http/https. Ideally we would have a way to turn off non-SSL service if we configure SSL key material -- maybe the logic could be to configure https if SSL key material is provided, and http if there's no key material. And only configure both if both ports are explicitly provided.

The other is around that key material. In your PR the user has to provide file paths to the key material. However due to snap confinement there's a limited number of places the services can actually read data from, and users would see failing services if the ssl files are not in a suitable place.
I'd suggest to check in the CLI part of the code that the file is readable for the snap so users get an early warning, and document the constraints around this.
Alternatively, the code could be changed so that the key material itself is used as a parameter (instead of the file names).

It would also be great to have functional tests for this feature.

Thanks again!

@marceloneppel
Copy link
Member Author

Hey @marceloneppel thanks for this welcome contribution!

I'm wondering about two things regarding parametrization.

One is relatively minor thing, aiui with SSL key material present we'd configure both http/https. Ideally we would have a way to turn off non-SSL service if we configure SSL key material -- maybe the logic could be to configure https if SSL key material is provided, and http if there's no key material. And only configure both if both ports are explicitly provided.

The other is around that key material. In your PR the user has to provide file paths to the key material. However due to snap confinement there's a limited number of places the services can actually read data from, and users would see failing services if the ssl files are not in a suitable place. I'd suggest to check in the CLI part of the code that the file is readable for the snap so users get an early warning, and document the constraints around this. Alternatively, the code could be changed so that the key material itself is used as a parameter (instead of the file names).

It would also be great to have functional tests for this feature.

Thanks again!

Hi, @sabaini! Thanks for the feedback. I'm going to work on those updates.

Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
Copy link
Contributor

@lmlg lmlg left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, great stuff :)

…est-1

Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
…est-1

Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
@marceloneppel
Copy link
Member Author

Hey @marceloneppel thanks for this welcome contribution!

I'm wondering about two things regarding parametrization.

One is relatively minor thing, aiui with SSL key material present we'd configure both http/https. Ideally we would have a way to turn off non-SSL service if we configure SSL key material -- maybe the logic could be to configure https if SSL key material is provided, and http if there's no key material. And only configure both if both ports are explicitly provided.

The other is around that key material. In your PR the user has to provide file paths to the key material. However due to snap confinement there's a limited number of places the services can actually read data from, and users would see failing services if the ssl files are not in a suitable place. I'd suggest to check in the CLI part of the code that the file is readable for the snap so users get an early warning, and document the constraints around this. Alternatively, the code could be changed so that the key material itself is used as a parameter (instead of the file names).

It would also be great to have functional tests for this feature.

Thanks again!

Hi @sabaini! I fixed the issues I was facing and updated this PR based on your comments.

The code is now turning off the HTTP service if no HTTP port is specified and the SSL material is specified. It's possible to turn on both HTTP and HTTPS services if both the HTTP port and the SSL material are specified.

Also, to avoid file permission issues, the new parameters were changed from file paths to the SSL material:

sudo microceph enable rgw --ssl-certificate="$(sudo base64 -w0 ~/server.crt)" --ssl-private-key="$(sudo base64 -w0 ~/server.key)"

What's missing are the functional tests. I'll add them next week.

Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
@marceloneppel
Copy link
Member Author

@sabaini, I added a functional test through 5f60871.

@marceloneppel marceloneppel requested a review from sabaini August 16, 2024 21:14
Copy link
Collaborator

@sabaini sabaini left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you @marceloneppel, very nice!
Some commentary / Q inline

Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
@marceloneppel marceloneppel requested a review from sabaini August 19, 2024 12:35
Copy link
Collaborator

@sabaini sabaini left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, thank you!

@sabaini
Copy link
Collaborator

sabaini commented Aug 19, 2024

@UtkarshBhatthere think you had requested changes too -- please re-review?

Copy link
Contributor

@UtkarshBhatthere UtkarshBhatthere left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, 👍🏼 for good testing coverage.

@UtkarshBhatthere UtkarshBhatthere merged commit f85ee55 into canonical:main Aug 20, 2024
@UtkarshBhatthere
Copy link
Contributor

@marceloneppel as a programmer how was your experience extending the RGW service capabilities in MC ? Asking specifically about using the service placement interface. Was is easy to understand ?

@marceloneppel
Copy link
Member Author

@marceloneppel as a programmer how was your experience extending the RGW service capabilities in MC ? Asking specifically about using the service placement interface. Was is easy to understand ?

Hi, @UtkarshBhatthere! It was easy to understand, specifically the placement interface. The part where I struggled a little bit was related to the RGW configuration, not MC.

@UtkarshBhatthere
Copy link
Contributor

Great :D

@maximsachs
Copy link

Hey @marceloneppel thanks for this welcome contribution!
I'm wondering about two things regarding parametrization.
One is relatively minor thing, aiui with SSL key material present we'd configure both http/https. Ideally we would have a way to turn off non-SSL service if we configure SSL key material -- maybe the logic could be to configure https if SSL key material is provided, and http if there's no key material. And only configure both if both ports are explicitly provided.
The other is around that key material. In your PR the user has to provide file paths to the key material. However due to snap confinement there's a limited number of places the services can actually read data from, and users would see failing services if the ssl files are not in a suitable place. I'd suggest to check in the CLI part of the code that the file is readable for the snap so users get an early warning, and document the constraints around this. Alternatively, the code could be changed so that the key material itself is used as a parameter (instead of the file names).
It would also be great to have functional tests for this feature.
Thanks again!

Hi @sabaini! I fixed the issues I was facing and updated this PR based on your comments.

The code is now turning off the HTTP service if no HTTP port is specified and the SSL material is specified. It's possible to turn on both HTTP and HTTPS services if both the HTTP port and the SSL material are specified.

Also, to avoid file permission issues, the new parameters were changed from file paths to the SSL material:

sudo microceph enable rgw --ssl-certificate="$(sudo base64 -w0 ~/server.crt)" --ssl-private-key="$(sudo base64 -w0 ~/server.key)"

What's missing are the functional tests. I'll add them next week.

Hi @marceloneppel I spent the last two days frustrated trying to find how to add SSL to the rados gateway until I found your PR! Awesome work! A thing I am still confused about, is since you switched from filepath to base64 encoded cert and key, when I update the keys how is the reloading intended to work?

I normally set up LetsEncrypt to automatically renew certificates, and would then expect to restart the gateway service with: sudo systemctl restart snap.microceph.rgw.service. But since the cert/key are effectively "hardcoded" this would not lead to a restart with renewed certificates.

So for now I would have to disable the rgw and re-enable it again with the updated certs in a deploy-hook on certbot, but that doesn't feel very clean.

I would love a way to simply swap out certs for LetsEncrypt compatibility, or if you have ideas on how this can be achieved without disabling the rgw that would be appreciated.

@UtkarshBhatthere
Copy link
Contributor

@maximsachs thanks for sharing your feedback on the user experience. I really appreciate it. May I request you to create a GitHub issue that expresses your expected UX ? This helps us keep track of the the task.

Gu1nness added a commit to Gu1nness/microceph that referenced this pull request Feb 7, 2025
This regression was introduced in canonical#355.

Closes: canonical#483
Gu1nness added a commit to Gu1nness/microceph that referenced this pull request Feb 7, 2025
This regression was introduced in canonical#355.

Closes: canonical#483
@Gu1nness Gu1nness mentioned this pull request Feb 7, 2025
9 tasks
Gu1nness added a commit to Gu1nness/microceph that referenced this pull request Feb 7, 2025
This regression was introduced in canonical#355.

Closes: canonical#483
Signed-off-by: Neha Oudin <neha@oudin.red>
Gu1nness added a commit to Gu1nness/microceph that referenced this pull request Feb 10, 2025
This regression was introduced in canonical#355.
This change was tested with an update of the current tests.

Closes: canonical#483
Signed-off-by: Neha Oudin <neha@oudin.red>
Gu1nness added a commit to Gu1nness/microceph that referenced this pull request Feb 10, 2025
This regression was introduced in canonical#355.
This change was tested with an update of the current unit tests.

Closes: canonical#483
Signed-off-by: Neha Oudin <neha@oudin.red>
Gu1nness added a commit to Gu1nness/microceph that referenced this pull request Feb 10, 2025
This regression was introduced in canonical#355.
This change was tested with an update of the current unit tests.

Closes: canonical#483
Signed-off-by: Neha Oudin <neha@oudin.red>
Gu1nness added a commit to Gu1nness/microceph that referenced this pull request Feb 10, 2025
This regression was introduced in canonical#355.
This change was tested with an update of the current unit tests.

Closes: canonical#483
Signed-off-by: Neha Oudin <neha.oudin@canonical.com>
Gu1nness added a commit to Gu1nness/microceph that referenced this pull request Feb 10, 2025
This regression was introduced in canonical#355.
This change was tested with an update of the current unit tests.

Closes: canonical#483
Signed-off-by: Neha Oudin <neha.oudin@canonical.com>
sabaini pushed a commit that referenced this pull request Feb 11, 2025
# Description

In #355 a regression was added where the `--port` rgw option is not
respected.
This PR fixes this regression, updates the tests in order to ensure that
it is respected in all contexts.

Fixes #483 

## Type of change

Please delete options that are not relevant.

- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to not work as expected)
- [ ] CleanCode (Code refactor, test updates, does not introduce
functional changes)
- [ ] Documentation update (Doc only change)

## How Has This Been Tested?

The unit tests were updated to reflect that change and confirm that the
option is respected when it is passed.


## Contributor's Checklist

Please check that you have:

- [x] self-reviewed the code in this PR.
- [x] added code comments, particularly in hard-to-understand areas.
- [ ] updated the user documentation with corresponding changes.
- [x] added tests to verify effectiveness of this change.

Signed-off-by: Neha Oudin <neha.oudin@canonical.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants