ceph: fix SignatureDoesNotMatch by using correct secret key when create bucket #11115

jeanvetorello · 2025-07-01T21:11:11Z

Description

This PR fixes an issue in the CephObjectStoreDriverImpl where the AWS S3 client was incorrectly initialized using the access key in place of both the access and secret key. This caused SignatureDoesNotMatch errors during bucket operations such as creation and policy updates when interacting with Ceph RGW using Signature V4.

Fix:
Replaced incorrect usage:

getS3Client(url, bucket.getAccessKey(), bucket.getAccessKey())

Impact:
Without this fix, CloudStack fails to perform S3 operations against Ceph RGW due to invalid signature generation, making the object storage integration unusable from the UI/API.

Steps to reproduce:

Configure a Ceph RGW object store in CloudStack.

Attempt to create a bucket via the UI or API.

Observe SignatureDoesNotMatch errors in management server logs.

Types of changes
 Bug fix (non-breaking change which fixes an issue)

 Breaking change (fix or feature that would cause existing functionality to change)

 New feature (non-breaking change which adds functionality)

 Enhancement (improves an existing feature and functionality)

 Cleanup (Code refactoring and cleanup, that may add test cases)

 build/CI

 test (unit or integration test code)
 
 Feature/Enhancement Scale or Bug Severity
Bug Severity
Minor to moderate – affects integration functionality with Ceph RGW for object storage.

Ensure bucket.getSecretKey() is used when building the S3 client. Previously, only getAccessKey() was passed for both key and secret, causing V4 signature validation failures during operations such as bucket creation and policy updates.

boring-cyborg · 2025-07-01T21:11:14Z

Congratulations on your first Pull Request and welcome to the Apache CloudStack community! If you have any issues or are unsure about any anything please check our Contribution Guide (https://github.com/apache/cloudstack/blob/main/CONTRIBUTING.md)
Here are some useful points:

In case of a new feature add useful documentation (raise doc PR at https://github.com/apache/cloudstack-documentation)
Be patient and persistent. It might take some time to get a review or get the final approval from the committers.
Pay attention to the quality of your code, ensure tests are passing and your PR doesn't have conflicts.
Please follow ASF Code of Conduct for all communication including (but not limited to) comments on Pull Requests, Issues, Mailing list and Slack.
Be sure to read the CloudStack Coding Conventions.
Apache CloudStack is a community-driven project and together we are making it better 🚀.
In case of doubts contact the developers at:
Mailing List: dev@cloudstack.apache.org (https://cloudstack.apache.org/mailing-lists.html)
Slack: https://apachecloudstack.slack.com/

DaanHoogland

clgtm

Copilot

Pull Request Overview

This PR fixes SignatureDoesNotMatch errors by ensuring the AWS S3 client is initialized with the correct secret key in CephObjectStoreDriverImpl.

Replaced the second credential parameter in getS3Client calls from bucket.getAccessKey() to bucket.getSecretKey().
Applied this correction across policy, versioning, and encryption bucket operations.

Comments suppressed due to low confidence (1)

plugins/storage/object/ceph/src/main/java/org/apache/cloudstack/storage/datastore/driver/CephObjectStoreDriverImpl.java:196

Add unit or integration tests to confirm that getS3Client is invoked with the correct secretKey parameter, ensuring Signature V4 operations succeed against Ceph RGW.

        AmazonS3 client = getS3Client(getStoreURL(storeId), bucket.getAccessKey(), bucket.getSecretKey());

Copilot · 2025-07-02T06:39:10Z

.../src/main/java/org/apache/cloudstack/storage/datastore/driver/CephObjectStoreDriverImpl.java

+        AmazonS3 client = getS3Client(getStoreURL(storeId), bucket.getAccessKey(), bucket.getSecretKey());
        client.setBucketPolicy(new SetBucketPolicyRequest(bucket.getName(), policyConfig));
    }

    @Override
    public BucketPolicy getBucketPolicy(BucketTO bucket, long storeId) {
-        AmazonS3 client = getS3Client(getStoreURL(storeId), bucket.getAccessKey(), bucket.getAccessKey());
+        AmazonS3 client = getS3Client(getStoreURL(storeId), bucket.getAccessKey(), bucket.getSecretKey());
        return client.getBucketPolicy(new GetBucketPolicyRequest(bucket.getName()));
    }

    @Override
    public void deleteBucketPolicy(BucketTO bucket, long storeId) {
-        AmazonS3 client = getS3Client(getStoreURL(storeId), bucket.getAccessKey(), bucket.getAccessKey());
+        AmazonS3 client = getS3Client(getStoreURL(storeId), bucket.getAccessKey(), bucket.getSecretKey());


[nitpick] Consider extracting the repeated getS3Client initialization into a private helper method to reduce duplication and improve readability across bucket operations.

DaanHoogland · 2025-07-02T06:39:43Z

@jeanvetorello , of you want this fix on an LTS version, rebase it on one of the older release-branches, please.

codecov · 2025-07-02T06:47:13Z

Codecov Report

Attention: Patch coverage is 0% with 5 lines in your changes missing coverage. Please review.

Project coverage is 16.57%. Comparing base (16c60c7) to head (a334e85).

Files with missing lines	Patch %	Lines
...ge/datastore/driver/CephObjectStoreDriverImpl.java	0.00%	5 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff            @@
##               main   #11115   +/-   ##
=========================================
  Coverage     16.57%   16.57%           
  Complexity    13968    13968           
=========================================
  Files          5743     5743           
  Lines        510494   510494           
  Branches      62075    62075           
=========================================
+ Hits          84617    84622    +5     
+ Misses       416415   416409    -6     
- Partials       9462     9463    +1

Flag	Coverage Δ
uitests	`3.90% <ø> (ø)`
unittests	`17.47% <0.00%> (+<0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

wido

CLGTM

boring-cyborg bot added the component:storage label Jul 1, 2025

DaanHoogland added the 3rd-party:ceph label Jul 2, 2025

DaanHoogland approved these changes Jul 2, 2025

View reviewed changes

DaanHoogland requested review from wido and Copilot July 2, 2025 06:38

DaanHoogland added this to the 4.21.0 milestone Jul 2, 2025

Copilot AI reviewed Jul 2, 2025

View reviewed changes

wido approved these changes Jul 2, 2025

View reviewed changes

sureshanaparti added this to Apache CloudStack 4.21.0 Jul 4, 2025

sureshanaparti moved this to In Progress in Apache CloudStack 4.21.0 Jul 4, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

ceph: fix SignatureDoesNotMatch by using correct secret key when create bucket #11115

ceph: fix SignatureDoesNotMatch by using correct secret key when create bucket #11115

Uh oh!

jeanvetorello commented Jul 1, 2025

Uh oh!

boring-cyborg bot commented Jul 1, 2025

Uh oh!

DaanHoogland left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Jul 2, 2025

Uh oh!

DaanHoogland commented Jul 2, 2025

Uh oh!

codecov bot commented Jul 2, 2025 •

edited

Loading

Uh oh!

wido left a comment

Uh oh!

Uh oh!

ceph: fix SignatureDoesNotMatch by using correct secret key when create bucket #11115

Are you sure you want to change the base?

ceph: fix SignatureDoesNotMatch by using correct secret key when create bucket #11115

Uh oh!

Conversation

jeanvetorello commented Jul 1, 2025

Description

Uh oh!

boring-cyborg bot commented Jul 1, 2025

Uh oh!

DaanHoogland left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Copilot AI Jul 2, 2025

Choose a reason for hiding this comment

Uh oh!

DaanHoogland commented Jul 2, 2025

Uh oh!

codecov bot commented Jul 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

wido left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

codecov bot commented Jul 2, 2025 •

edited

Loading