Pacific dashboard: unable to get RGW information
Hi, Our cluster is running Pacific 16.2.10. We have a problem using the dashboard to display information about RGWs configured in the cluster. When clicking on "Object Gateway", we get an error 500. Looking in the mgr logs, I found that the problem is that the RGW is accessed by its IP address rather than its name. As the RGW has SSL enabled, the certificate cannot be matched against the IP address. I digged into the configuration but I was not able to identify where an IP address rather than a name was used (I checked in particular the zonegroup parameters and names are used to define endpoints). Did I make something wrong in the configuration or is it a know issue when using SSL-enabled RGW? Best regards, Michel
I have a similar issue with how the dashboard tries to access an SSL protected RGW service. It doesn't use the correct name and doesn't allow for any way to override the RGW name that the dashboard uses. https://tracker.ceph.com/issues/59111 Bug #59111: dashboard should use rgw_dns_name when talking to rgw api - Dashboard - Ceph <https://tracker.ceph.com/issues/59111> Redmine tracker.ceph.com ________________________________ From: Michel Jouvin <michel.jouvin@ijclab.in2p3.fr> Sent: Tuesday, April 11, 2023 4:19 PM To: Ceph Users <ceph-users@ceph.io> Subject: [ceph-users] Pacific dashboard: unable to get RGW information Hi, Our cluster is running Pacific 16.2.10. We have a problem using the dashboard to display information about RGWs configured in the cluster. When clicking on "Object Gateway", we get an error 500. Looking in the mgr logs, I found that the problem is that the RGW is accessed by its IP address rather than its name. As the RGW has SSL enabled, the certificate cannot be matched against the IP address. I digged into the configuration but I was not able to identify where an IP address rather than a name was used (I checked in particular the zonegroup parameters and names are used to define endpoints). Did I make something wrong in the configuration or is it a know issue when using SSL-enabled RGW? Best regards, Michel _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
Hi, version 16.2.11 (which was just recently released) contains a fix for that. But it still doesn’t work with wildcard certificates, that’s still an issue for us. Zitat von Michel Jouvin <michel.jouvin@ijclab.in2p3.fr>:
Hi,
Our cluster is running Pacific 16.2.10. We have a problem using the dashboard to display information about RGWs configured in the cluster. When clicking on "Object Gateway", we get an error 500. Looking in the mgr logs, I found that the problem is that the RGW is accessed by its IP address rather than its name. As the RGW has SSL enabled, the certificate cannot be matched against the IP address.
I digged into the configuration but I was not able to identify where an IP address rather than a name was used (I checked in particular the zonegroup parameters and names are used to define endpoints). Did I make something wrong in the configuration or is it a know issue when using SSL-enabled RGW?
Best regards,
Michel _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
Thanks for these answers, I was not able to find information mentioning the problem, thus my email. I didn't try 16.2.11 because of the big mentioned by others in volume activation when using cephadm. Michel Sent from my mobile Le 11 avril 2023 22:28:37 Eugen Block <eblock@nde.ag> a écrit :
Hi,
version 16.2.11 (which was just recently released) contains a fix for that. But it still doesn’t work with wildcard certificates, that’s still an issue for us.
Zitat von Michel Jouvin <michel.jouvin@ijclab.in2p3.fr>:
Hi,
Our cluster is running Pacific 16.2.10. We have a problem using the dashboard to display information about RGWs configured in the cluster. When clicking on "Object Gateway", we get an error 500. Looking in the mgr logs, I found that the problem is that the RGW is accessed by its IP address rather than its name. As the RGW has SSL enabled, the certificate cannot be matched against the IP address.
I digged into the configuration but I was not able to identify where an IP address rather than a name was used (I checked in particular the zonegroup parameters and names are used to define endpoints). Did I make something wrong in the configuration or is it a know issue when using SSL-enabled RGW?
Best regards,
Michel _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
_______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
Right, I almost forgot that one, I stumbled upon the performance regression as well. :-/ Zitat von Michel Jouvin <michel.jouvin@ijclab.in2p3.fr>:
Thanks for these answers, I was not able to find information mentioning the problem, thus my email. I didn't try 16.2.11 because of the big mentioned by others in volume activation when using cephadm.
Michel Sent from my mobile Le 11 avril 2023 22:28:37 Eugen Block <eblock@nde.ag> a écrit :
Hi,
version 16.2.11 (which was just recently released) contains a fix for that. But it still doesn’t work with wildcard certificates, that’s still an issue for us.
Zitat von Michel Jouvin <michel.jouvin@ijclab.in2p3.fr>:
Hi,
Our cluster is running Pacific 16.2.10. We have a problem using the dashboard to display information about RGWs configured in the cluster. When clicking on "Object Gateway", we get an error 500. Looking in the mgr logs, I found that the problem is that the RGW is accessed by its IP address rather than its name. As the RGW has SSL enabled, the certificate cannot be matched against the IP address.
I digged into the configuration but I was not able to identify where an IP address rather than a name was used (I checked in particular the zonegroup parameters and names are used to define endpoints). Did I make something wrong in the configuration or is it a know issue when using SSL-enabled RGW?
Best regards,
Michel _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
_______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
Hi, My problem is the opposite ! I don't use SSL on RGWs, because I use a load balancer with HTTPS endpoint. so no problem with certificates and IP adresses. With 16.2.11, it does not work anymore because it uses DNS names, and those names are resolving to a management IP, which is not the network where I expose the RGWs... So for everyone to have a working dashboard, we need to be able to override that configuration, and set what ever we want as RGW endpoints. PS: I still don't use cephadm, but ceph-ansible. Perhaps things are different with containers. Le mardi 11 avril 2023, 22:26:28 CEST Eugen Block a écrit :
Hi,
version 16.2.11 (which was just recently released) contains a fix for that. But it still doesn’t work with wildcard certificates, that’s still an issue for us.
Zitat von Michel Jouvin <michel.jouvin@ijclab.in2p3.fr>:
Hi,
Our cluster is running Pacific 16.2.10. We have a problem using the dashboard to display information about RGWs configured in the cluster. When clicking on "Object Gateway", we get an error 500. Looking in the mgr logs, I found that the problem is that the RGW is accessed by its IP address rather than its name. As the RGW has SSL enabled, the certificate cannot be matched against the IP address.
I digged into the configuration but I was not able to identify where an IP address rather than a name was used (I checked in particular the zonegroup parameters and names are used to define endpoints). Did I make something wrong in the configuration or is it a know issue when using SSL-enabled RGW?
Best regards,
Michel _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
_______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
I forgot, there's a similar bug around that : https://tracker.ceph.com/issues/58811 Le mardi 11 avril 2023, 22:45:28 CEST Gilles Mocellin a écrit :
Hi,
My problem is the opposite ! I don't use SSL on RGWs, because I use a load balancer with HTTPS endpoint. so no problem with certificates and IP adresses. With 16.2.11, it does not work anymore because it uses DNS names, and those
names are resolving to a management IP, which is not the network where I
expose the RGWs...
So for everyone to have a working dashboard, we need to be able to override
that configuration, and set what ever we want as RGW endpoints.
PS: I still don't use cephadm, but ceph-ansible. Perhaps things are different
with containers.
Le mardi 11 avril 2023, 22:26:28 CEST Eugen Block a écrit :
Hi,
version 16.2.11 (which was just recently released) contains a fix for that. But it still doesn’t work with wildcard certificates, that’s still an issue for us.
Zitat von Michel Jouvin <michel.jouvin@ijclab.in2p3.fr>:
Hi,
Our cluster is running Pacific 16.2.10. We have a problem using the dashboard to display information about RGWs configured in the cluster. When clicking on "Object Gateway", we get an error 500. Looking in the mgr logs, I found that the problem is that the RGW is accessed by its IP address rather than its name. As the RGW has SSL enabled, the certificate cannot be matched against the IP address.
I digged into the configuration but I was not able to identify where an IP address rather than a name was used (I checked in particular the zonegroup parameters and names are used to define endpoints). Did I make something wrong in the configuration or is it a know issue when using SSL-enabled RGW?
Best regards,
Michel _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
_______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
_______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
It feels like removing the option to set the rgw api host (in previous releases 'ceph dashboard set-rgw-api-host') is a regression. Apparently, there are many use-cases not covered by the automatic setting. I don't know the reasons behind the decision to implement it that way, but maybe it's worth looking at it again? Zitat von Gilles Mocellin <gilles.mocellin@nuagelibre.org>:
I forgot, there's a similar bug around that : https://tracker.ceph.com/issues/58811
Le mardi 11 avril 2023, 22:45:28 CEST Gilles Mocellin a écrit :
Hi,
My problem is the opposite ! I don't use SSL on RGWs, because I use a load balancer with HTTPS endpoint. so no problem with certificates and IP adresses. With 16.2.11, it does not work anymore because it uses DNS names, and those
names are resolving to a management IP, which is not the network where I
expose the RGWs...
So for everyone to have a working dashboard, we need to be able to override
that configuration, and set what ever we want as RGW endpoints.
PS: I still don't use cephadm, but ceph-ansible. Perhaps things are different
with containers.
Le mardi 11 avril 2023, 22:26:28 CEST Eugen Block a écrit :
Hi,
version 16.2.11 (which was just recently released) contains a fix for that. But it still doesn’t work with wildcard certificates, that’s still an issue for us.
Zitat von Michel Jouvin <michel.jouvin@ijclab.in2p3.fr>:
Hi,
Our cluster is running Pacific 16.2.10. We have a problem using the dashboard to display information about RGWs configured in the cluster. When clicking on "Object Gateway", we get an error 500. Looking in the mgr logs, I found that the problem is that the RGW is accessed by its IP address rather than its name. As the RGW has SSL enabled, the certificate cannot be matched against the IP address.
I digged into the configuration but I was not able to identify where an IP address rather than a name was used (I checked in particular the zonegroup parameters and names are used to define endpoints). Did I make something wrong in the configuration or is it a know issue when using SSL-enabled RGW?
Best regards,
Michel _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
_______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
_______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
_______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
participants (4)
-
Eugen Block
-
Gilles Mocellin
-
Michel Jouvin
-
Wyll Ingersoll