rgw: add seperate option for verify ssl for vault KMS engine

Signed-off-by: Jiffin Tony Thottan <jthottan@redhat.com>
(cherry picked from commit 4a93faa2eec8077edb4c35a20b6b66bc610a6e4a)

Conflicts:
	src/common/options/rgw.yaml.in
- added required changes in options.cc and legacy_config_opts.h

Signed-off-by: Jiffin Tony Thottan <jthottan@redhat.com>

diff --git a/src/common/legacy_config_opts.h b/src/common/legacy_config_opts.h
index 8e2438bf0f66cdb37b568a6b2a1bbfef420fdc7d..75de330b6d1ba7cda042393e88d69511152593b2 100644 (file)
--- a/src/common/legacy_config_opts.h
+++ b/src/common/legacy_config_opts.h
@@ -1509,6 +1509,7 @@ OPTION(rgw_crypt_vault_addr, OPT_STR) // Vault server base address
 OPTION(rgw_crypt_vault_prefix, OPT_STR) // Optional URL prefix to Vault secret path
 OPTION(rgw_crypt_vault_secret_engine, OPT_STR) // kv, transit or other supported secret engines
 OPTION(rgw_crypt_vault_namespace, OPT_STR) // Vault Namespace (only availabe in Vault Enterprise Version)
+OPTION(rgw_crypt_vault_verify_ssl, OPT_BOOL) // should we try to verify vault's ssl
 
 OPTION(rgw_crypt_kmip_addr, OPT_STR) // kmip server address
 OPTION(rgw_crypt_kmip_ca_path, OPT_STR) // ca for kmip servers

diff --git a/src/common/options.cc b/src/common/options.cc
index 96eabd2d94eeac09d48289c9cc7b5141db90f25e..bd6f3e6d74535db25d3121102665bcd8c96d626d 100644 (file)
--- a/src/common/options.cc
+++ b/src/common/options.cc
@@ -7175,6 +7175,10 @@ std::vector<Option> get_rgw_options() {
       "rgw_crypt_vault_auth",
       "rgw_crypt_vault_addr"}),
 
+    Option("rgw_crypt_vault_verify_ssl", Option::TYPE_BOOL, Option::LEVEL_ADVANCED)
+    .set_default(true)
+    .set_description("Should RGW verify the vault server SSL certificate."),
+
     Option("rgw_crypt_kmip_addr", Option::TYPE_STR, Option::LEVEL_ADVANCED)
     .set_default("")
     .set_description("kmip server address"),

diff --git a/src/rgw/rgw_kms.cc b/src/rgw/rgw_kms.cc
index 8542d483d48270de4e39ec2247b56bb04f5e295b..92c593ed640974734df972f61739d2cea07f1a5f 100644 (file)
--- a/src/rgw/rgw_kms.cc
+++ b/src/rgw/rgw_kms.cc
@@ -252,6 +252,8 @@ protected:
       secret_req.append_header("X-Vault-Namespace", vault_namespace);
     }
 
+    secret_req.set_verify_ssl(cct->_conf->rgw_crypt_vault_verify_ssl);
+
     res = secret_req.process(null_yield);
     if (res < 0) {
       ldout(cct, 0) << "ERROR: Request to Vault failed with error " << res << dendl;