Ceph RADOS-GW object storage plugin issue

[yadvr]

Following review and testing of the feature, some missing features and issues can be addressed in the next phase: #8389 (comment)

The following are applicable only for the Ceph RGW object-storage plugin:

• Bucket creation fails when any of the options are specified or these options aren't supported: quota, versioning & encryption, bucket policy
• During Bucket creation, locking feature/option is ignored
• User quota not enforced/configured
• Bucket policy fails and throws exception:

• UI browser doesn't work (due to cors issue, couldn't figure out how to configure radosgw for that)

ISSUE TYPE

• Improvement Request

COMPONENT NAME

Ceph RGW object storage plugin

CLOUDSTACK VERSION

4.20

[DaanHoogland]

@wido @rohityadavcloud , given that #8389 is merged, can this be closed? (and marked with milestone 4.20.0)

[wido]

@wido @rohityadavcloud , given that #8389 is merged, can this be closed? (and marked with milestone 4.20.0)

Correct. Closing this one.

[levindecaro]

i got CORS issue 403 error via ACS browser UI, is it currently a limitation?

[wido]

My CORS knowledge is limited, but I think this needs to be addressed on the RGW site where you make sure it sends out the proper CORS headers. Without them your browser will block your access.

[levindecaro]

I’ve been looking into this, and it seems like Ceph RGW and CORS configurations are actually based on bucket policies. Unless ACS sets a default bucket policy when creating a bucket, otherwise the browser UI will not work. I’m thinking about other options, like using an intermediate proxy. In the meantime, I’d like to see if we can disable the browser UI as an option in the management configuration. That way, users won’t be confused. What do you think?

[levindecaro]

@wido

I managed to workaround it with haproxy, here is the configuration which will allow ACS object storage browser UI operate with Ceph RGW.

global
  log 127.0.0.1 local2
  lua-load /etc/haproxy/cors.lua ## from https://github.com/haproxytech/haproxy-lua-cors
  chroot /var/lib/haproxy
  pidfile /var/run/haproxy.pid
  maxconn 4000
  user haproxy
  group haproxy
  daemon
  stats socket /var/lib/haproxy/stats
  ssl-default-bind-ciphers PROFILE=SYSTEM
  ssl-default-server-ciphers PROFILE=SYSTEM
  tune.bufsize 32768
  tune.maxrewrite 2048

defaults
  mode http
  log global
  option httplog
  option dontlognull
  option http-server-close
  option forwardfor except 127.0.0.0/8
  option redispatch
  retries 3
  timeout http-request 10s
  timeout queue 1m
  timeout connect 10s
  timeout client 1m
  timeout server 1m
  timeout http-keep-alive 10s
  timeout check 10s
  maxconn 30000

frontend https-in
  mode http
  bind 0.0.0.0:443 ssl crt /etc/haproxy/server.pem
  default_backend rgw-server-9443
  capture request header Origin len 128
  acl acs_origin req.hdr(Origin) -m str https://portal.acs.example.com
  http-request lua.cors "*" ".example.com" "*"  if acs_origin
  use_backend rgw-server-9443-origin if acs_origin

backend rgw-server-9443
  balance roundrobin
  mode http
  server apac-1a-sds-node-0 apac-1a-sds-node-0:9443 check ssl verify none
  server apac-1a-sds-node-1 apac-1a-sds-node-1:9443 check ssl verify none
  server apac-1a-sds-node-2 apac-1a-sds-node-2:9443 check ssl verify none
  server apac-1a-sds-node-3 apac-1a-sds-node-3:9443 check ssl verify none

backend rgw-server-9443-origin
  balance roundrobin
  mode http
  http-response lua.cors
  server apac-1a-sds-node-0 apac-1a-sds-node-0:9443 check ssl verify none
  server apac-1a-sds-node-1 apac-1a-sds-node-1:9443 check ssl verify none
  server apac-1a-sds-node-2 apac-1a-sds-node-2:9443 check ssl verify none
  server apac-1a-sds-node-3 apac-1a-sds-node-3:9443 check ssl verify none