Comment 1 for bug 2021560

Revision history for this message
Nobuto Murata (nobuto) wrote :

Here is the config reference:

https://docs.ceph.com/en/latest/radosgw/config-ref/?highlight=trust%20forwarded%20https#confval-rgw_trust_forwarded_https
> Enable this option to trust the Forwarded and X-Forwarded-Proto headers sent by the proxy when determining whether the connection is secure. This is required for some features, such as server side encryption. (Never enable this setting if you do not have a trusted proxy in front of radosgw, or else malicious users will be able to set these headers in any request.)

And the charm has the following for Apache2 as a reverse proxy and TLS termination:
https://github.com/openstack/charm-ceph-radosgw/blob/4484b0f0ed0c3b32947cfaa96025dbcc489c4f14/templates/openstack_https_frontend.conf#L24
> RequestHeader set X-Forwarded-Proto "https"

So I think we can enable the config when TLS is configured by the charm.