Feature #65470: Beast lacks ssl_short_trust option to reload ssl certificate without restart - rgw - Ceph

Actions

Copy link

Feature #65470

open

Beast lacks ssl_short_trust option to reload ssl certificate without restart

Added by Brien Dieterle almost 2 years ago. Updated 5 months ago.

Status:

Pending Backport

Priority:

Normal

Assignee:

Casey Bodley

Target version:

% Done:

Source:

Backport:

squid tentacle

Reviewed:

Affected Versions:

Ceph - v18.2.1

Pull request ID:

65842

Tags (freeform):

backport_processed

Merge Commit:

a4df7f9e61e3e93fef603649c44b0d6182d5dd8b

Fixed In:

v20.3.0-3819-ga4df7f9e61

Released In:

Upkeep Timestamp:

2025-10-30T12:56:55+00:00

Description

Previously civetweb rgw had an option (ssl_short_trust) to automatically reload certs, for instance when they are short-lived and rotated frequently:

https://github.com/civetweb/civetweb/blob/master/docs/UserManual.md#ssl_short_trust-no

When SSL was added to Beast this option was overlooked: https://tracker.ceph.com/issues/22832

This regression(?) is mentioned in the discussion here:

https://github.com/ceph/ceph/pull/20464#issuecomment-464867120

We are testing SSL with RGW using Rook in Kubernetes, and everything seems to work fine other than the certificate expiry, since it is being renewed by Cert-Manager fairly often. The certificate file on disk is updated, radosgw just needs a way to re-read it.

Restarting the rgw is an option but seems a bit heavy-handed and would require some more integration with Kubernetes to gracefully roll the deployment (and/or managed by Rook Operator)

Related issues 2 (2 open — 0 closed)