Re: Dashboard 'SignatureDoesNotMatch' error when connecting to RGW
On Wed, May 27, 2026 at 6:36 AM Iztok Gregori via ceph-users <ceph-users@ceph.io> wrote:
On 27/05/26 12:17, Eugen Block via ceph-users wrote:
Hi,
Zitat von Iztok Gregori via ceph-users <ceph-users@ceph.io>:
On 27/05/26 09:36, Eugen Block via ceph-users wrote:
The description in this tracker [0] looks identical, but it is supposed to be fixed. Do you have rgw_dns_name set?
Yes, at certain point I configured client.rgw rgw_dns_name to the FQDN belonging to the virtual IP of the ingress service.
does it mean that it works now?
No, still doesn't work. To try I've also remove it and then again set it, but without luck.
I also tried to call the API endpoint directly with curl using the dashboard credentials and found that from 'older' versions of curl (provided for example by Rocky 9) the command gives me the same error ('SignatureDoesNotMatch'), but when I was using newer one (8.5.0 on Ubuntu 22.04 and 8.9.1 on Rocky 10) it correctly answer my query.
regarding curl versions, i had fixed its sigv4 bugs for curl 8.0.0 with https://github.com/curl/curl/pull/9995 but i believe the dashboard uses its own custom sigv2 implementation in src/pybind/mgr/dashboard/awsauth.py
Could it be the problem?
BTW, how you 'unset' a configuration variable, you just put a empty string or you use the rm option?
ceph config set client.rgw rgw_dns_name '' or ceph config rm client.rgw rgw_dns_name ?
That's the correct one (config rm).
Thank you! I sometimes get lost in the documentation :-)
Cheers Iztok _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
On 27/05/26 15:00, Casey Bodley wrote:
On Wed, May 27, 2026 at 6:36 AM Iztok Gregori via ceph-users <ceph-users@ceph.io> wrote:
On 27/05/26 12:17, Eugen Block via ceph-users wrote:
Hi,
Zitat von Iztok Gregori via ceph-users <ceph-users@ceph.io>:
On 27/05/26 09:36, Eugen Block via ceph-users wrote:
The description in this tracker [0] looks identical, but it is supposed to be fixed. Do you have rgw_dns_name set?
Yes, at certain point I configured client.rgw rgw_dns_name to the FQDN belonging to the virtual IP of the ingress service.
does it mean that it works now?
No, still doesn't work. To try I've also remove it and then again set it, but without luck.
I also tried to call the API endpoint directly with curl using the dashboard credentials and found that from 'older' versions of curl (provided for example by Rocky 9) the command gives me the same error ('SignatureDoesNotMatch'), but when I was using newer one (8.5.0 on Ubuntu 22.04 and 8.9.1 on Rocky 10) it correctly answer my query.
regarding curl versions, i had fixed its sigv4 bugs for curl 8.0.0 with https://github.com/curl/curl/pull/9995
but i believe the dashboard uses its own custom sigv2 implementation in src/pybind/mgr/dashboard/awsauth.py
The only difference in headers that I see in my tests between the old and the new version of curl is the signing of 'x-amz-content-sha256'. Looking in the awsauth.py file I don't see any reference to this header. Is it possible that is needed in Tentacle? I see a definition in src/rgw/rgw_common.h (v20.2.1) #define RGW_ATTR_SHA256 RGW_ATTR_PREFIX "x-amz-content-sha256" which is not present in the same file in squid (v19.2.3) Iztok
Could it be the problem?
BTW, how you 'unset' a configuration variable, you just put a empty string or you use the rm option?
ceph config set client.rgw rgw_dns_name '' or ceph config rm client.rgw rgw_dns_name ?
That's the correct one (config rm).
Thank you! I sometimes get lost in the documentation :-)
Cheers Iztok _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
participants (2)
-
Casey Bodley
-
Iztok Gregori