diff options
| author | Casey Bodley <cbodley@redhat.com> | 2018-10-22 17:04:55 +0200 |
|---|---|---|
| committer | Casey Bodley <cbodley@redhat.com> | 2018-10-22 20:56:22 +0200 |
| commit | d3dd5a996dbce5e113c361c838551cf22e52bfb6 (patch) | |
| tree | 8148f0545dc59bf553ad358931cf341d774c7065 /doc/radosgw | |
| parent | Merge pull request #23103 from ifed01/wip-ifed-bluefs-migrate (diff) | |
| download | ceph-d3dd5a996dbce5e113c361c838551cf22e52bfb6.tar.xz ceph-d3dd5a996dbce5e113c361c838551cf22e52bfb6.zip | |
common: add config option rgw_trust_forwarded_https
Signed-off-by: Casey Bodley <cbodley@redhat.com>
Diffstat (limited to 'doc/radosgw')
| -rw-r--r-- | doc/radosgw/config-ref.rst | 11 | ||||
| -rw-r--r-- | doc/radosgw/encryption.rst | 5 |
2 files changed, 16 insertions, 0 deletions
diff --git a/doc/radosgw/config-ref.rst b/doc/radosgw/config-ref.rst index 37c9b81f746..abaeafba821 100644 --- a/doc/radosgw/config-ref.rst +++ b/doc/radosgw/config-ref.rst @@ -576,6 +576,17 @@ Swift Settings :Default: ``false`` +``rgw trust forwarded https`` + +:Description: When a proxy in front of radosgw is used for ssl termination, radosgw + does not know whether incoming http connections are secure. Enable + this option to trust the ``Forwarded`` and ``X-Forwarded-Proto`` headers + sent by the proxy when determining whether the connection is secure. + This is required for some features, such as server side encryption. +:Type: Boolean +:Default: ``false`` + + Logging Settings ================ diff --git a/doc/radosgw/encryption.rst b/doc/radosgw/encryption.rst index a7bb7e2e931..ea89e502ab0 100644 --- a/doc/radosgw/encryption.rst +++ b/doc/radosgw/encryption.rst @@ -9,6 +9,11 @@ with 3 options for the management of encryption keys. Server-side encryption means that the data is sent over HTTP in its unencrypted form, and the Ceph Object Gateway stores that data in the Ceph Storage Cluster in encrypted form. +.. note:: Requests for server-side encryption must be sent over a secure HTTPS + connection to avoid sending secrets in plaintext. If a proxy is used + for SSL termination, ``rgw trust forwarded https`` must be enabled + before forwarded requests will be trusted as secure. + Customer-Provided Keys ====================== |