You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by "jeanvetorello (via GitHub)" <gi...@apache.org> on 2025/07/01 21:11:14 UTC
[PR] ceph: fix SignatureDoesNotMatch by using correct secret key when create bucket [cloudstack]
jeanvetorello opened a new pull request, #11115:
URL: https://github.com/apache/cloudstack/pull/11115
### Description
This PR fixes an issue in the `CephObjectStoreDriverImpl` where the AWS S3 client was incorrectly initialized using the access key in place of both the access and secret key. This caused `SignatureDoesNotMatch` errors during bucket operations such as creation and policy updates when interacting with Ceph RGW using Signature V4.
**Fix:**
Replaced incorrect usage:
```java
getS3Client(url, bucket.getAccessKey(), bucket.getAccessKey())
Impact:
Without this fix, CloudStack fails to perform S3 operations against Ceph RGW due to invalid signature generation, making the object storage integration unusable from the UI/API.
Steps to reproduce:
Configure a Ceph RGW object store in CloudStack.
Attempt to create a bucket via the UI or API.
Observe SignatureDoesNotMatch errors in management server logs.
Types of changes
Bug fix (non-breaking change which fixes an issue)
Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)
build/CI
test (unit or integration test code)
Feature/Enhancement Scale or Bug Severity
Bug Severity
Minor to moderate – affects integration functionality with Ceph RGW for object storage.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ceph: fix SignatureDoesNotMatch by using correct secret key when create bucket [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #11115:
URL: https://github.com/apache/cloudstack/pull/11115#issuecomment-3146680159
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 14520
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ceph: fix SignatureDoesNotMatch by using correct secret key when create bucket [cloudstack]
Posted by "rohityadavcloud (via GitHub)" <gi...@apache.org>.
rohityadavcloud commented on PR #11115:
URL: https://github.com/apache/cloudstack/pull/11115#issuecomment-3146270604
@sureshanaparti can we include this in 4.21?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ceph: fix SignatureDoesNotMatch by using correct secret key when create bucket [cloudstack]
Posted by "boring-cyborg[bot] (via GitHub)" <gi...@apache.org>.
boring-cyborg[bot] commented on PR #11115:
URL: https://github.com/apache/cloudstack/pull/11115#issuecomment-3147657011
Awesome work, congrats on your first merged pull request!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ceph: fix SignatureDoesNotMatch by using correct secret key when create bucket [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #11115:
URL: https://github.com/apache/cloudstack/pull/11115#issuecomment-3146623950
@sureshanaparti a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ceph: fix SignatureDoesNotMatch by using correct secret key when create bucket [cloudstack]
Posted by "sureshanaparti (via GitHub)" <gi...@apache.org>.
sureshanaparti merged PR #11115:
URL: https://github.com/apache/cloudstack/pull/11115
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ceph: fix SignatureDoesNotMatch by using correct secret key when create bucket [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
DaanHoogland commented on PR #11115:
URL: https://github.com/apache/cloudstack/pull/11115#issuecomment-3026642053
@jeanvetorello , of you want this fix on an LTS version, rebase it on one of the older release-branches, please.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ceph: fix SignatureDoesNotMatch by using correct secret key when create bucket [cloudstack]
Posted by "boring-cyborg[bot] (via GitHub)" <gi...@apache.org>.
boring-cyborg[bot] commented on PR #11115:
URL: https://github.com/apache/cloudstack/pull/11115#issuecomment-3025541678
Congratulations on your first Pull Request and welcome to the Apache CloudStack community! If you have any issues or are unsure about any anything please check our Contribution Guide (https://github.com/apache/cloudstack/blob/main/CONTRIBUTING.md)
Here are some useful points:
- In case of a new feature add useful documentation (raise doc PR at https://github.com/apache/cloudstack-documentation)
- Be patient and persistent. It might take some time to get a review or get the final approval from the committers.
- Pay attention to the quality of your code, ensure tests are passing and your PR doesn't have conflicts.
- Please follow [ASF Code of Conduct](https://github.com/apache/.github/blob/main/.github/CODE_OF_CONDUCT.md) for all communication including (but not limited to) comments on Pull Requests, Issues, Mailing list and Slack.
- Be sure to read the [CloudStack Coding Conventions](https://cwiki.apache.org/confluence/display/CLOUDSTACK/Coding+conventions).
Apache CloudStack is a community-driven project and together we are making it better 🚀.
In case of doubts contact the developers at:
Mailing List: dev@cloudstack.apache.org (https://cloudstack.apache.org/mailing-lists.html)
Slack: https://apachecloudstack.slack.com/
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ceph: fix SignatureDoesNotMatch by using correct secret key when create bucket [cloudstack]
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #11115:
URL: https://github.com/apache/cloudstack/pull/11115#issuecomment-3026658511
## [Codecov](https://app.codecov.io/gh/apache/cloudstack/pull/11115?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
All modified and coverable lines are covered by tests :white_check_mark:
> Project coverage is 3.90%. Comparing base [(`16c60c7`)](https://app.codecov.io/gh/apache/cloudstack/commit/16c60c7528a3ee731bceaa9113d5e6a76b22a246?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) to head [(`a334e85`)](https://app.codecov.io/gh/apache/cloudstack/commit/a334e85a6bb9673fe783043b676820e007979cc5?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
> :exclamation: There is a different number of reports uploaded between BASE (16c60c7) and HEAD (a334e85). Click for more details.
>
> <details><summary>HEAD has 1 upload less than BASE</summary>
>
>| Flag | BASE (16c60c7) | HEAD (a334e85) |
>|------|------|------|
>|unittests|1|0|
></details>
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## main #11115 +/- ##
=============================================
- Coverage 16.57% 3.90% -12.68%
=============================================
Files 5743 414 -5329
Lines 510494 33746 -476748
Branches 62075 6075 -56000
=============================================
- Hits 84617 1317 -83300
+ Misses 416415 32273 -384142
+ Partials 9462 156 -9306
```
| [Flag](https://app.codecov.io/gh/apache/cloudstack/pull/11115/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [uitests](https://app.codecov.io/gh/apache/cloudstack/pull/11115/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `3.90% <ø> (ø)` | |
| [unittests](https://app.codecov.io/gh/apache/cloudstack/pull/11115/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
</details>
[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/apache/cloudstack/pull/11115?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ceph: fix SignatureDoesNotMatch by using correct secret key when create bucket [cloudstack]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #11115:
URL: https://github.com/apache/cloudstack/pull/11115#discussion_r2179242291
##########
plugins/storage/object/ceph/src/main/java/org/apache/cloudstack/storage/datastore/driver/CephObjectStoreDriverImpl.java:
##########
@@ -193,19 +193,19 @@ public void setBucketPolicy(BucketTO bucket, String policy, long storeId) {
policyConfig = "{\"Version\":\"2012-10-17\",\"Statement\":[]}";
}
- AmazonS3 client = getS3Client(getStoreURL(storeId), bucket.getAccessKey(), bucket.getAccessKey());
+ AmazonS3 client = getS3Client(getStoreURL(storeId), bucket.getAccessKey(), bucket.getSecretKey());
client.setBucketPolicy(new SetBucketPolicyRequest(bucket.getName(), policyConfig));
}
@Override
public BucketPolicy getBucketPolicy(BucketTO bucket, long storeId) {
- AmazonS3 client = getS3Client(getStoreURL(storeId), bucket.getAccessKey(), bucket.getAccessKey());
+ AmazonS3 client = getS3Client(getStoreURL(storeId), bucket.getAccessKey(), bucket.getSecretKey());
return client.getBucketPolicy(new GetBucketPolicyRequest(bucket.getName()));
}
@Override
public void deleteBucketPolicy(BucketTO bucket, long storeId) {
- AmazonS3 client = getS3Client(getStoreURL(storeId), bucket.getAccessKey(), bucket.getAccessKey());
+ AmazonS3 client = getS3Client(getStoreURL(storeId), bucket.getAccessKey(), bucket.getSecretKey());
Review Comment:
[nitpick] Consider extracting the repeated `getS3Client` initialization into a private helper method to reduce duplication and improve readability across bucket operations.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ceph: fix SignatureDoesNotMatch by using correct secret key when create bucket [cloudstack]
Posted by "sureshanaparti (via GitHub)" <gi...@apache.org>.
sureshanaparti commented on PR #11115:
URL: https://github.com/apache/cloudstack/pull/11115#issuecomment-3146623213
@blueorangutan package
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org