Ceph » mgr » Dashboard

I can find this in MGR logs

RGW REST API failed GET req status: 403
RGW REST API failed request with status code 403
(b'{"Code":"SignatureDoesNotMatch","Message":"","RequestId":"tx00000e94834dee1f'
b'126e2-0064d612aa-2f83e-default","HostId":"2f83e-default-default"}')
Traceback (most recent call last):
File "/usr/share/ceph/mgr/dashboard/services/rgw_client.py", line 417, in init
self.userid = self._get_user_id(self.admin_path) if self.got_keys_from_config \
File "/usr/share/ceph/mgr/dashboard/rest_client.py", line 542, in func_wrapper
**kwargs)
File "/usr/share/ceph/mgr/dashboard/services/rgw_client.py", line 452, in _get_user_id
response = request()
File "/usr/share/ceph/mgr/dashboard/rest_client.py", line 325, in call
data, raw_content, headers)
File "/usr/share/ceph/mgr/dashboard/rest_client.py", line 428, in do_request
resp.content)
dashboard.rest_client.RequestException: RGW REST API failed request with status code 403
(b'{"Code":"SignatureDoesNotMatch","Message":"","RequestId":"tx00000e94834dee1f'
b'126e2-0064d612aa-2f83e-default","HostId":"2f83e-default-default"}')

So we figured out the problem was that since Reef dashboard started accessing the RGW using instance names, instead of FQDN that could be specified via custom variable in previous CEPH versions.

Since this variable can no longer be specified, a workaround was to modify the zone json config using

radosgw-admin zonegroup get

Then adding the short hostnames of instances into hostnames field and then committing the changed json back to RGW config

We found this solution in https://www.spinics.net/lists/ceph-users/msg76635.html

Directly related:
https://tracker.ceph.com/issues/59111

It would seem to me the simplest solution would just simply be to explicitly respect

rgw_dns_name

1. If

   rgw_dns_name

   is configured for a daemon, use that. If not...
2. If:
   1. SSL/TLS (HTTPS) IS configured for the daemon: Attempt connection to the daemon's hostname (current behavior); if this fails (times out, does not resolve), continue to...
   2. SSL/TLS (HTTPS) IS NOT configured for the daemon: Attempt connection to the daemon's IP address (previous behavior); if this fails, continue to...
3. If:
   1. SSL/TLS (HTTPS) IS configured for the daemon: Attempt connection to the daemon's IP address
   2. SSL/TLS (HTTPS) IS NOT configured for the daemon: Attempt connection to the daemon's hostname
4. Lastly, if none of the above succeed, return errors and consider RGW daemon as inaccessible.

• "automagic" configuration
• explicitly overriding said automagic handling (especially important in the event of different network scoping)
• SSL/TLS conditions, both with and without the IP address SAN'd on the certificate
• No DNS configuration whatsoever (which, sure, is silly for an RGW, but best to not make assumptions of consumer infra/usage)

Thank you! Based on the comments I made a PR which could fix this. Testing it out now. https://github.com/ceph/ceph/pull/53133