From: Or Friedmann Date: Mon, 18 May 2020 15:15:25 +0000 (+0300) Subject: rgw: create rgw-cache example directory X-Git-Tag: v16.1.0~2137^2~1 X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=94c81f3094222d49a9c12d088667f58926b1cbf5;p=ceph.git rgw: create rgw-cache example directory Signed-off-by: Or Friedmann --- diff --git a/doc/radosgw/nginx-default.conf b/doc/radosgw/nginx-default.conf deleted file mode 100644 index 9d49d156868f..000000000000 --- a/doc/radosgw/nginx-default.conf +++ /dev/null @@ -1,91 +0,0 @@ -#config cache size and path to the cache directory, you should make sure that the user that is running nginx have permissions to access the cache directory -#max_size means that Nginx will not cache more than 20G, It should be tuned to a larger number if the /data/cache is bigger -proxy_cache_path /data/cache levels=3:2 keys_zone=mycache:999m max_size=20G inactive=1d use_temp_path=off; -upstream rgws { - # List of all rgws (ips or resolvable names) - server rgw1:8000 max_fails=2 fail_timeout=5s; - server rgw2:8000 max_fails=2 fail_timeout=5s; - server rgw3:8000 max_fails=2 fail_timeout=5s; -} -server { - listen 80; - server_name cacher; - location /authentication { - internal; - limit_except GET { deny all; } - proxy_pass http://rgws$request_uri; - proxy_pass_request_body off; - proxy_set_header Host $host; - # setting x-rgw-auth allow the RGW the ability to only authorize the request without fetching the obj data - proxy_set_header x-rgw-auth "yes"; - proxy_set_header Authorization $http_authorization; - proxy_http_version 1.1; - proxy_method $request_method; - # Do not convert HEAD requests into GET requests - proxy_cache_convert_head off; - error_page 404 = @outage; - proxy_intercept_errors on; - if ($request_uri = "/"){ - return 200; - } - # URI included with question mark is not being cached - if ($request_uri ~* (\?)){ - return 200; - } - } - location @outage{ - return 403; - } - location / { - limit_except GET { deny all; } - auth_request /authentication; - proxy_pass http://rgws; - set $authvar ''; - # if $do_not_cache is not empty the request would not be cached, this is relevant for list op for example - set $do_not_cache ''; - # the IP or name of the RGWs - rewrite_by_lua_file /etc/nginx/nginx-lua-file.lua; - #proxy_set_header Authorization $http_authorization; - # my cache configured at the top of the file - proxy_cache mycache; - proxy_cache_lock_timeout 0s; - proxy_cache_lock_age 1000s; - proxy_http_version 1.1; - set $date $aws_auth_date; - # Getting 403 if this header not set - proxy_set_header Host $host; - # Cache all 200 OK's for 1 day - proxy_cache_valid 200 206 1d; - # Use stale cache file in all errors from upstream if we can - proxy_cache_use_stale updating; - proxy_cache_background_update on; - # Try to check if etag have changed, if yes, do not re-fetch from rgw the object - proxy_cache_revalidate on; - # Lock the cache so that only one request can populate it at a time - proxy_cache_lock on; - # prevent convertion of head requests to get requests - proxy_cache_convert_head off; - # Listing all buckets should not be cached - if ($request_uri = "/"){ - set $do_not_cache "no"; - set $date $http_x_amz_date; - } - # URI including question mark are not supported to prevent bucket listing cache - if ($request_uri ~* (\?)){ - set $do_not_cache "no"; - set $date $http_x_amz_date; - } - # Only aws4 requests are being cached - As the aws auth module supporting only aws v2 - if ($http_authorization !~* "aws4_request") { - set $date $http_x_amz_date; - } - # Use the original x-amz-date if the aws auth module didn't create one - proxy_set_header x-amz-date $date; - proxy_set_header X-Amz-Cache $authvar; - proxy_no_cache $do_not_cache; - proxy_set_header Authorization $awsauth; - # This is on which content the nginx to use for hashing the cache keys - proxy_cache_key "$request_uri$request_method$request_body"; - client_max_body_size 20G; - } -} diff --git a/doc/radosgw/nginx-lua-file.lua b/doc/radosgw/nginx-lua-file.lua deleted file mode 100644 index d776cb700f44..000000000000 --- a/doc/radosgw/nginx-lua-file.lua +++ /dev/null @@ -1,26 +0,0 @@ -local check = ngx.req.get_headers()["AUTHORIZATION"] -local uri = ngx.var.request_uri -local ngx_re = require "ngx.re" -local hdrs = ngx.req.get_headers() ---Take all signedheaders names, this for creating the X-Amz-Cache which is necessary to override range header to be able to readahead an object -local res, err = ngx_re.split(check,"SignedHeaders=") -local res2, err2 = ngx_re.split(res[2],",") -local res3, err3 = ngx_re.split(res2[1],";") -local t = {} -local concathdrs = string.char(0x00) -for i = 1, #res3, 1 do - if hdrs[res3[i]] ~= nil then ---0xB1 is the separator between header name and value - t[i] = res3[i] .. string.char(0xB1) .. hdrs[res3[i]] ---0xB2 is the separator between headers - concathdrs = concathdrs .. string.char(0xB2) .. t[i] - end -end --- check if the authorization header is not empty -if check ~= nil then - local xamzcache = concathdrs:sub(2) - xamzcache = xamzcache .. string.char(0xB2) .. "Authorization" .. string.char(0xB1) .. check - if xamzcache:find("aws4_request") ~= nil and uri ~= "/" and uri:find("?") == nil then - ngx.var.authvar = xamzcache - end -end diff --git a/doc/radosgw/nginx-noprefetch.conf b/doc/radosgw/nginx-noprefetch.conf deleted file mode 100644 index e7ec3350a95a..000000000000 --- a/doc/radosgw/nginx-noprefetch.conf +++ /dev/null @@ -1,81 +0,0 @@ -#config cache size and path to the cache directory, you should make sure that the user that is running nginx have permissions to access the cache directory -#max_size means that Nginx will not cache more than 20G, It should be tuned to a larger number if the /data/cache is bigger -proxy_cache_path /data/cache levels=3:2 keys_zone=mycache:999m max_size=20G inactive=1d use_temp_path=off; -upstream rgws { - # List of all rgws (ips or resolvable names) - server rgw1:8000 max_fails=2 fail_timeout=5s; - server rgw2:8000 max_fails=2 fail_timeout=5s; - server rgw3:8000 max_fails=2 fail_timeout=5s; -} -server { - listen 80; - server_name cacher; - location /authentication { - internal; - limit_except GET { deny all; } - proxy_pass http://rgws$request_uri; - proxy_pass_request_body off; - proxy_set_header Host $host; - # setting x-rgw-auth allow the RGW the ability to only authorize the request without fetching the obj data - proxy_set_header x-rgw-auth "yes"; - proxy_set_header Authorization $http_authorization; - proxy_http_version 1.1; - proxy_method $request_method; - # Do not convert HEAD requests into GET requests - proxy_cache_convert_head off; - error_page 404 = @outage; - proxy_intercept_errors on; - if ($request_uri = "/"){ - return 200; - } - # URI included with question mark is not being cached - if ($request_uri ~* (\?)){ - return 200; - } - } - location @outage{ - return 403; - } - location / { - limit_except GET { deny all; } - auth_request /authentication; - proxy_pass http://rgws; - # if $do_not_cache is not empty the request would not be cached, this is relevant for list op for example - set $do_not_cache ''; - # the IP or name of the RGWs - #proxy_set_header Authorization $http_authorization; - # my cache configured at the top of the file - proxy_cache mycache; - proxy_cache_lock_timeout 0s; - proxy_cache_lock_age 1000s; - proxy_http_version 1.1; - # Getting 403 if this header not set - proxy_set_header Host $host; - # Cache all 200 OK's for 1 day - proxy_cache_valid 200 206 1d; - # Use stale cache file in all errors from upstream if we can - proxy_cache_use_stale updating; - proxy_cache_background_update on; - # Try to check if etag have changed, if yes, do not re-fetch from rgw the object - proxy_cache_revalidate on; - # Lock the cache so that only one request can populate it at a time - proxy_cache_lock on; - # prevent convertion of head requests to get requests - proxy_cache_convert_head off; - # Listing all buckets should not be cached - if ($request_uri = "/"){ - set $do_not_cache "no"; - } - # URI including question mark are not supported to prevent bucket listing cache - if ($request_uri ~* (\?)){ - set $do_not_cache "no"; - } - # Use the original x-amz-date if the aws auth module didn't create one - proxy_no_cache $do_not_cache; - proxy_set_header Authorization $http_authorization; - proxy_set_header Range $http_range; - # This is on which content the nginx to use for hashing the cache keys - proxy_cache_key "$request_uri$request_method$request_body$http_range"; - client_max_body_size 20G; - } -} diff --git a/doc/radosgw/nginx-slicing.conf b/doc/radosgw/nginx-slicing.conf deleted file mode 100644 index d9359ddebf68..000000000000 --- a/doc/radosgw/nginx-slicing.conf +++ /dev/null @@ -1,93 +0,0 @@ -#config cache size and path to the cache directory, you should make sure that the user that is running nginx have permissions to access the cache directory -#max_size means that Nginx will not cache more than 20G, It should be tuned to a larger number if the /data/cache is bigger -proxy_cache_path /data/cache levels=3:2 keys_zone=mycache:999m max_size=20G inactive=1d use_temp_path=off; -upstream rgws { - # List of all rgws (ips or resolvable names) - server rgw1:8000 max_fails=2 fail_timeout=5s; - server rgw2:8000 max_fails=2 fail_timeout=5s; - server rgw3:8000 max_fails=2 fail_timeout=5s; -} -server { - listen 80; - server_name cacher; - location /authentication { - internal; - limit_except GET { deny all; } - proxy_pass http://rgws$request_uri; - proxy_pass_request_body off; - proxy_set_header Host $host; - # setting x-rgw-auth allow the RGW the ability to only authorize the request without fetching the obj data - proxy_set_header x-rgw-auth "yes"; - proxy_set_header Authorization $http_authorization; - proxy_http_version 1.1; - proxy_method $request_method; - # Do not convert HEAD requests into GET requests - proxy_cache_convert_head off; - error_page 404 = @outage; - proxy_intercept_errors on; - if ($request_uri = "/"){ - return 200; - } - # URI included with question mark is not being cached - if ($request_uri ~* (\?)){ - return 200; - } - } - location @outage{ - return 403; - } - location / { - slice 1m; - limit_except GET { deny all; } - auth_request /authentication; - proxy_set_header Range $slice_range; - proxy_pass http://rgws; - set $authvar ''; - # if $do_not_cache is not empty the request would not be cached, this is relevant for list op for example - set $do_not_cache ''; - # the IP or name of the RGWs - rewrite_by_lua_file /etc/nginx/nginx-lua-file.lua; - #proxy_set_header Authorization $http_authorization; - # my cache configured at the top of the file - proxy_cache mycache; - proxy_cache_lock_timeout 0s; - proxy_cache_lock_age 1000s; - proxy_http_version 1.1; - set $date $aws_auth_date; - # Getting 403 if this header not set - proxy_set_header Host $host; - # Cache all 200 OK's for 1 day - proxy_cache_valid 200 206 1d; - # Use stale cache file in all errors from upstream if we can - proxy_cache_use_stale updating; - proxy_cache_background_update on; - # Try to check if etag have changed, if yes, do not re-fetch from rgw the object - proxy_cache_revalidate on; - # Lock the cache so that only one request can populate it at a time - proxy_cache_lock on; - # prevent convertion of head requests to get requests - proxy_cache_convert_head off; - # Listing all buckets should not be cached - if ($request_uri = "/"){ - set $do_not_cache "no"; - set $date $http_x_amz_date; - } - # URI including question mark are not supported to prevent bucket listing cache - if ($request_uri ~* (\?)){ - set $do_not_cache "no"; - set $date $http_x_amz_date; - } - # Only aws4 requests are being cached - As the aws auth module supporting only aws v2 - if ($http_authorization !~* "aws4_request") { - set $date $http_x_amz_date; - } - # Use the original x-amz-date if the aws auth module didn't create one - proxy_set_header x-amz-date $date; - proxy_set_header X-Amz-Cache $authvar; - proxy_no_cache $do_not_cache; - proxy_set_header Authorization $awsauth; - # This is on which content the nginx to use for hashing the cache keys - proxy_cache_key "$request_uri$request_method$request_body$slice_range"; - client_max_body_size 20G; - } -} diff --git a/doc/radosgw/nginx.conf b/doc/radosgw/nginx.conf deleted file mode 100644 index f0938ad0498c..000000000000 --- a/doc/radosgw/nginx.conf +++ /dev/null @@ -1,40 +0,0 @@ - -user nginx; -#Process per core -worker_processes auto; -pid /var/run/nginx.pid; - -events { -#Number of connections per worker - worker_connections 1024; -} - - -http { - lua_package_path '/usr/local/openresty/lualib/?.lua;;'; - aws_auth $aws_token { - # access key and secret key of the cache - access_key cache; - secret_key cache; - service s3; - region us-east-1; - } - # This map is used to choose the original authorization header if the aws_auth module refuse to create one - map $aws_token $awsauth { - default $http_authorization; - ~. $aws_token; # Regular expression to match any value - } - include /etc/nginx/mime.types; - default_type application/octet-stream; - log_format main '$remote_addr - $remote_user [$time_local] "$request" ' - '$status $body_bytes_sent "$http_referer" ' - '"$http_user_agent" "$http_x_forwarded_for"'; - error_log /var/log/nginx/error.log; - access_log /var/log/nginx/access.log main; - - sendfile on; - tcp_nodelay on; - keepalive_timeout 65; - include /etc/nginx/conf.d/*.conf; -} - diff --git a/doc/radosgw/rgw-cache.rst b/doc/radosgw/rgw-cache.rst index 29f8ded0ecda..11af120d814b 100644 --- a/doc/radosgw/rgw-cache.rst +++ b/doc/radosgw/rgw-cache.rst @@ -28,7 +28,7 @@ On subsequent accesses to the cached object, Nginx will satisfy requests for alr Auth API ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -This APIValidates a specific authenticated access being made to the cache, using RGW's knowledge of the client credentials and stored access policy. +This API Validates a specific authenticated access being made to the cache, using RGW's knowledge of the client credentials and stored access policy. Returns success if the encapsulated request would be granted. Cache API @@ -84,6 +84,8 @@ $ sudo ln -sf /usr/local/openresty/bin/openresty /usr/bin/nginx Put in-place your nginx configuration files and edit them according to your environment: +All nginx conf files are under: https://github.com/ceph/ceph/tree/master/examples/rgw-cache + nginx.conf should go to /etc/nginx/nginx.conf nginx-lua-file.lua should go to /etc/nginx/nginx-lua-file.lua nginx-default.conf should go to /etc/nginx/conf.d/nginx-default.conf diff --git a/examples/rgw-cache/nginx-default.conf b/examples/rgw-cache/nginx-default.conf new file mode 100644 index 000000000000..9d49d156868f --- /dev/null +++ b/examples/rgw-cache/nginx-default.conf @@ -0,0 +1,91 @@ +#config cache size and path to the cache directory, you should make sure that the user that is running nginx have permissions to access the cache directory +#max_size means that Nginx will not cache more than 20G, It should be tuned to a larger number if the /data/cache is bigger +proxy_cache_path /data/cache levels=3:2 keys_zone=mycache:999m max_size=20G inactive=1d use_temp_path=off; +upstream rgws { + # List of all rgws (ips or resolvable names) + server rgw1:8000 max_fails=2 fail_timeout=5s; + server rgw2:8000 max_fails=2 fail_timeout=5s; + server rgw3:8000 max_fails=2 fail_timeout=5s; +} +server { + listen 80; + server_name cacher; + location /authentication { + internal; + limit_except GET { deny all; } + proxy_pass http://rgws$request_uri; + proxy_pass_request_body off; + proxy_set_header Host $host; + # setting x-rgw-auth allow the RGW the ability to only authorize the request without fetching the obj data + proxy_set_header x-rgw-auth "yes"; + proxy_set_header Authorization $http_authorization; + proxy_http_version 1.1; + proxy_method $request_method; + # Do not convert HEAD requests into GET requests + proxy_cache_convert_head off; + error_page 404 = @outage; + proxy_intercept_errors on; + if ($request_uri = "/"){ + return 200; + } + # URI included with question mark is not being cached + if ($request_uri ~* (\?)){ + return 200; + } + } + location @outage{ + return 403; + } + location / { + limit_except GET { deny all; } + auth_request /authentication; + proxy_pass http://rgws; + set $authvar ''; + # if $do_not_cache is not empty the request would not be cached, this is relevant for list op for example + set $do_not_cache ''; + # the IP or name of the RGWs + rewrite_by_lua_file /etc/nginx/nginx-lua-file.lua; + #proxy_set_header Authorization $http_authorization; + # my cache configured at the top of the file + proxy_cache mycache; + proxy_cache_lock_timeout 0s; + proxy_cache_lock_age 1000s; + proxy_http_version 1.1; + set $date $aws_auth_date; + # Getting 403 if this header not set + proxy_set_header Host $host; + # Cache all 200 OK's for 1 day + proxy_cache_valid 200 206 1d; + # Use stale cache file in all errors from upstream if we can + proxy_cache_use_stale updating; + proxy_cache_background_update on; + # Try to check if etag have changed, if yes, do not re-fetch from rgw the object + proxy_cache_revalidate on; + # Lock the cache so that only one request can populate it at a time + proxy_cache_lock on; + # prevent convertion of head requests to get requests + proxy_cache_convert_head off; + # Listing all buckets should not be cached + if ($request_uri = "/"){ + set $do_not_cache "no"; + set $date $http_x_amz_date; + } + # URI including question mark are not supported to prevent bucket listing cache + if ($request_uri ~* (\?)){ + set $do_not_cache "no"; + set $date $http_x_amz_date; + } + # Only aws4 requests are being cached - As the aws auth module supporting only aws v2 + if ($http_authorization !~* "aws4_request") { + set $date $http_x_amz_date; + } + # Use the original x-amz-date if the aws auth module didn't create one + proxy_set_header x-amz-date $date; + proxy_set_header X-Amz-Cache $authvar; + proxy_no_cache $do_not_cache; + proxy_set_header Authorization $awsauth; + # This is on which content the nginx to use for hashing the cache keys + proxy_cache_key "$request_uri$request_method$request_body"; + client_max_body_size 20G; + } +} diff --git a/examples/rgw-cache/nginx-lua-file.lua b/examples/rgw-cache/nginx-lua-file.lua new file mode 100644 index 000000000000..d776cb700f44 --- /dev/null +++ b/examples/rgw-cache/nginx-lua-file.lua @@ -0,0 +1,26 @@ +local check = ngx.req.get_headers()["AUTHORIZATION"] +local uri = ngx.var.request_uri +local ngx_re = require "ngx.re" +local hdrs = ngx.req.get_headers() +--Take all signedheaders names, this for creating the X-Amz-Cache which is necessary to override range header to be able to readahead an object +local res, err = ngx_re.split(check,"SignedHeaders=") +local res2, err2 = ngx_re.split(res[2],",") +local res3, err3 = ngx_re.split(res2[1],";") +local t = {} +local concathdrs = string.char(0x00) +for i = 1, #res3, 1 do + if hdrs[res3[i]] ~= nil then +--0xB1 is the separator between header name and value + t[i] = res3[i] .. string.char(0xB1) .. hdrs[res3[i]] +--0xB2 is the separator between headers + concathdrs = concathdrs .. string.char(0xB2) .. t[i] + end +end +-- check if the authorization header is not empty +if check ~= nil then + local xamzcache = concathdrs:sub(2) + xamzcache = xamzcache .. string.char(0xB2) .. "Authorization" .. string.char(0xB1) .. check + if xamzcache:find("aws4_request") ~= nil and uri ~= "/" and uri:find("?") == nil then + ngx.var.authvar = xamzcache + end +end diff --git a/examples/rgw-cache/nginx-noprefetch.conf b/examples/rgw-cache/nginx-noprefetch.conf new file mode 100644 index 000000000000..e7ec3350a95a --- /dev/null +++ b/examples/rgw-cache/nginx-noprefetch.conf @@ -0,0 +1,81 @@ +#config cache size and path to the cache directory, you should make sure that the user that is running nginx have permissions to access the cache directory +#max_size means that Nginx will not cache more than 20G, It should be tuned to a larger number if the /data/cache is bigger +proxy_cache_path /data/cache levels=3:2 keys_zone=mycache:999m max_size=20G inactive=1d use_temp_path=off; +upstream rgws { + # List of all rgws (ips or resolvable names) + server rgw1:8000 max_fails=2 fail_timeout=5s; + server rgw2:8000 max_fails=2 fail_timeout=5s; + server rgw3:8000 max_fails=2 fail_timeout=5s; +} +server { + listen 80; + server_name cacher; + location /authentication { + internal; + limit_except GET { deny all; } + proxy_pass http://rgws$request_uri; + proxy_pass_request_body off; + proxy_set_header Host $host; + # setting x-rgw-auth allow the RGW the ability to only authorize the request without fetching the obj data + proxy_set_header x-rgw-auth "yes"; + proxy_set_header Authorization $http_authorization; + proxy_http_version 1.1; + proxy_method $request_method; + # Do not convert HEAD requests into GET requests + proxy_cache_convert_head off; + error_page 404 = @outage; + proxy_intercept_errors on; + if ($request_uri = "/"){ + return 200; + } + # URI included with question mark is not being cached + if ($request_uri ~* (\?)){ + return 200; + } + } + location @outage{ + return 403; + } + location / { + limit_except GET { deny all; } + auth_request /authentication; + proxy_pass http://rgws; + # if $do_not_cache is not empty the request would not be cached, this is relevant for list op for example + set $do_not_cache ''; + # the IP or name of the RGWs + #proxy_set_header Authorization $http_authorization; + # my cache configured at the top of the file + proxy_cache mycache; + proxy_cache_lock_timeout 0s; + proxy_cache_lock_age 1000s; + proxy_http_version 1.1; + # Getting 403 if this header not set + proxy_set_header Host $host; + # Cache all 200 OK's for 1 day + proxy_cache_valid 200 206 1d; + # Use stale cache file in all errors from upstream if we can + proxy_cache_use_stale updating; + proxy_cache_background_update on; + # Try to check if etag have changed, if yes, do not re-fetch from rgw the object + proxy_cache_revalidate on; + # Lock the cache so that only one request can populate it at a time + proxy_cache_lock on; + # prevent convertion of head requests to get requests + proxy_cache_convert_head off; + # Listing all buckets should not be cached + if ($request_uri = "/"){ + set $do_not_cache "no"; + } + # URI including question mark are not supported to prevent bucket listing cache + if ($request_uri ~* (\?)){ + set $do_not_cache "no"; + } + # Use the original x-amz-date if the aws auth module didn't create one + proxy_no_cache $do_not_cache; + proxy_set_header Authorization $http_authorization; + proxy_set_header Range $http_range; + # This is on which content the nginx to use for hashing the cache keys + proxy_cache_key "$request_uri$request_method$request_body$http_range"; + client_max_body_size 20G; + } +} diff --git a/examples/rgw-cache/nginx-slicing.conf b/examples/rgw-cache/nginx-slicing.conf new file mode 100644 index 000000000000..d9359ddebf68 --- /dev/null +++ b/examples/rgw-cache/nginx-slicing.conf @@ -0,0 +1,93 @@ +#config cache size and path to the cache directory, you should make sure that the user that is running nginx have permissions to access the cache directory +#max_size means that Nginx will not cache more than 20G, It should be tuned to a larger number if the /data/cache is bigger +proxy_cache_path /data/cache levels=3:2 keys_zone=mycache:999m max_size=20G inactive=1d use_temp_path=off; +upstream rgws { + # List of all rgws (ips or resolvable names) + server rgw1:8000 max_fails=2 fail_timeout=5s; + server rgw2:8000 max_fails=2 fail_timeout=5s; + server rgw3:8000 max_fails=2 fail_timeout=5s; +} +server { + listen 80; + server_name cacher; + location /authentication { + internal; + limit_except GET { deny all; } + proxy_pass http://rgws$request_uri; + proxy_pass_request_body off; + proxy_set_header Host $host; + # setting x-rgw-auth allow the RGW the ability to only authorize the request without fetching the obj data + proxy_set_header x-rgw-auth "yes"; + proxy_set_header Authorization $http_authorization; + proxy_http_version 1.1; + proxy_method $request_method; + # Do not convert HEAD requests into GET requests + proxy_cache_convert_head off; + error_page 404 = @outage; + proxy_intercept_errors on; + if ($request_uri = "/"){ + return 200; + } + # URI included with question mark is not being cached + if ($request_uri ~* (\?)){ + return 200; + } + } + location @outage{ + return 403; + } + location / { + slice 1m; + limit_except GET { deny all; } + auth_request /authentication; + proxy_set_header Range $slice_range; + proxy_pass http://rgws; + set $authvar ''; + # if $do_not_cache is not empty the request would not be cached, this is relevant for list op for example + set $do_not_cache ''; + # the IP or name of the RGWs + rewrite_by_lua_file /etc/nginx/nginx-lua-file.lua; + #proxy_set_header Authorization $http_authorization; + # my cache configured at the top of the file + proxy_cache mycache; + proxy_cache_lock_timeout 0s; + proxy_cache_lock_age 1000s; + proxy_http_version 1.1; + set $date $aws_auth_date; + # Getting 403 if this header not set + proxy_set_header Host $host; + # Cache all 200 OK's for 1 day + proxy_cache_valid 200 206 1d; + # Use stale cache file in all errors from upstream if we can + proxy_cache_use_stale updating; + proxy_cache_background_update on; + # Try to check if etag have changed, if yes, do not re-fetch from rgw the object + proxy_cache_revalidate on; + # Lock the cache so that only one request can populate it at a time + proxy_cache_lock on; + # prevent convertion of head requests to get requests + proxy_cache_convert_head off; + # Listing all buckets should not be cached + if ($request_uri = "/"){ + set $do_not_cache "no"; + set $date $http_x_amz_date; + } + # URI including question mark are not supported to prevent bucket listing cache + if ($request_uri ~* (\?)){ + set $do_not_cache "no"; + set $date $http_x_amz_date; + } + # Only aws4 requests are being cached - As the aws auth module supporting only aws v2 + if ($http_authorization !~* "aws4_request") { + set $date $http_x_amz_date; + } + # Use the original x-amz-date if the aws auth module didn't create one + proxy_set_header x-amz-date $date; + proxy_set_header X-Amz-Cache $authvar; + proxy_no_cache $do_not_cache; + proxy_set_header Authorization $awsauth; + # This is on which content the nginx to use for hashing the cache keys + proxy_cache_key "$request_uri$request_method$request_body$slice_range"; + client_max_body_size 20G; + } +} diff --git a/examples/rgw-cache/nginx.conf b/examples/rgw-cache/nginx.conf new file mode 100644 index 000000000000..f0938ad0498c --- /dev/null +++ b/examples/rgw-cache/nginx.conf @@ -0,0 +1,40 @@ + +user nginx; +#Process per core +worker_processes auto; +pid /var/run/nginx.pid; + +events { +#Number of connections per worker + worker_connections 1024; +} + + +http { + lua_package_path '/usr/local/openresty/lualib/?.lua;;'; + aws_auth $aws_token { + # access key and secret key of the cache + access_key cache; + secret_key cache; + service s3; + region us-east-1; + } + # This map is used to choose the original authorization header if the aws_auth module refuse to create one + map $aws_token $awsauth { + default $http_authorization; + ~. $aws_token; # Regular expression to match any value + } + include /etc/nginx/mime.types; + default_type application/octet-stream; + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"'; + error_log /var/log/nginx/error.log; + access_log /var/log/nginx/access.log main; + + sendfile on; + tcp_nodelay on; + keepalive_timeout 65; + include /etc/nginx/conf.d/*.conf; +} +