s3 backend fails with invalid certificate when using s3 compatible storage

> It appears a few of the other options have this functionality already, so we would need to add the support for boto3.

What options are you talking about? 's3_store_host' for instance?

What do you mean by "adding support for boto3"? Do you think this feature would require changes to boto3 itself?

I think we could add a "verify=path/to/cert/bundle.pem" (see https://boto3.amazonaws.com/v1/documentation/api/latest/reference/core/session.html#boto3.session.Session.client) argument to the "session.client()" call here https://github.com/openstack/glance_store/blob/0c60291637d1c941dcd8d2e022acb22ba0bed440/glance_store/_drivers/s3.py#L503 .

No I don’t think we’d need to make changes to boto itself. I think we probably just need to add what you suggested so that we have an option to overide the path to the cert bundle.

I was testing adding support to Kolla for s3 backend and it didn’t seem like anything worked other than setting the ENV var during the container build process so figured the best place to add support for overriding the cert was upstream as a glance configuration.

So I put together https://review.opendev.org/c/openstack/glance_store/+/893980 that we may end up discussing during the next PTG if this solves your issue. Could you take a look at it and try it?

We recently came across this very same thing (also while trying to integrate a Kolla-based OpenStack with our on-prem S3 Ceph-based). We can confirm the linked patch works and allowed us to use our own CA certificates.

Cyril, could you update the patch in order to revive it? We can also volunteer to do it, as long as someone else reviews it.

Hello,

I rebased the patch, let's see if the CI passes. Then it's just a matter of reviewing it :)

Thanks for testing the patch, this helps a lot!

Hi Cyril,

We've just tested this again with the rebased patch and everything is working properly. I've already given it my +1.

Thanx to you for fixing this!

Change abandoned by "Dr. Jens Harbott <email address hidden>" on branch: stable/2023.1
Review: https://review.opendev.org/c/openstack/glance_store/+/935503
Reason: stable/2023.1 branch of this repo is about to be deleted.
To be able to do that, all open patches need to be abandoned.
Please cherry pick the patch to unmaintained/2023.1 if you want to
further work on this patch.

This issue was fixed in the openstack/glance_store 4.9.0 Epoxy release.

This issue was fixed in the openstack/glance_store 4.8.2 Dalmatian release.