From 8df30c11ee6fd29cb09029cc3c391277f77dd7e0 Mon Sep 17 00:00:00 2001
From: Scooby Husky <garrettstone499@gmail.com>
Date: Sat, 14 Mar 2026 13:56:33 -0500
Subject: [PATCH] Re-enable Ceph dashboard SSL to fix SAML http/https URL
 mismatch

X-Forwarded-Proto approach didn't work - Ceph dashboard SAML doesn't
read it. Re-enabling native SSL so the dashboard sees https:// URLs
directly. Updated both Istio and Envoy Gateway backends for TLS with
insecureSkipVerify for the self-signed cert.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 infrastructure/rook-ceph/cluster-values.yaml              | 4 ++--
 infrastructure/rook-ceph/manifests/envoy-backend.yaml     | 5 ++++-
 infrastructure/rook-ceph/manifests/envoy-route.yaml       | 6 ------
 .../rook-ceph/manifests/istio-destinationrule.yaml        | 4 +++-
 .../rook-ceph/manifests/istio-virtualservice.yaml         | 8 ++------
 5 files changed, 11 insertions(+), 16 deletions(-)

diff --git a/infrastructure/rook-ceph/cluster-values.yaml b/infrastructure/rook-ceph/cluster-values.yaml
index 317df38..3bfcdd0 100644
--- a/infrastructure/rook-ceph/cluster-values.yaml
+++ b/infrastructure/rook-ceph/cluster-values.yaml
@@ -62,8 +62,8 @@ cephClusterSpec:
   # Dashboard configuration
   dashboard:
     enabled: true
-    ssl: false  # TLS handled by ingress
-    port: 7000
+    ssl: true
+    port: 8443
 
   # Network configuration
   network:
diff --git a/infrastructure/rook-ceph/manifests/envoy-backend.yaml b/infrastructure/rook-ceph/manifests/envoy-backend.yaml
index e37dd50..6d05791 100644
--- a/infrastructure/rook-ceph/manifests/envoy-backend.yaml
+++ b/infrastructure/rook-ceph/manifests/envoy-backend.yaml
@@ -7,4 +7,7 @@ spec:
   endpoints:
     - fqdn:
         hostname: rook-ceph-mgr-dashboard.rook-ceph.svc.cluster.local
-        port: 7000
+        port: 8443
+  tls:
+    insecureSkipVerify: true
+    sni: rook-ceph-mgr-dashboard.rook-ceph.svc.cluster.local
diff --git a/infrastructure/rook-ceph/manifests/envoy-route.yaml b/infrastructure/rook-ceph/manifests/envoy-route.yaml
index 4698ec2..5796c35 100644
--- a/infrastructure/rook-ceph/manifests/envoy-route.yaml
+++ b/infrastructure/rook-ceph/manifests/envoy-route.yaml
@@ -17,12 +17,6 @@ spec:
         - path:
             type: PathPrefix
             value: /
-      filters:
-        - type: RequestHeaderModifier
-          requestHeaderModifier:
-            set:
-              - name: X-Forwarded-Proto
-                value: https
       backendRefs:
         - group: gateway.envoyproxy.io
           kind: Backend
diff --git a/infrastructure/rook-ceph/manifests/istio-destinationrule.yaml b/infrastructure/rook-ceph/manifests/istio-destinationrule.yaml
index 6f8546c..5a233be 100644
--- a/infrastructure/rook-ceph/manifests/istio-destinationrule.yaml
+++ b/infrastructure/rook-ceph/manifests/istio-destinationrule.yaml
@@ -7,4 +7,6 @@ spec:
   host: rook-ceph-mgr-dashboard.rook-ceph.svc.cluster.local
   trafficPolicy:
     tls:
-      mode: DISABLE
+      mode: SIMPLE
+      sni: rook-ceph-mgr-dashboard.rook-ceph.svc.cluster.local
+      insecureSkipVerify: true
diff --git a/infrastructure/rook-ceph/manifests/istio-virtualservice.yaml b/infrastructure/rook-ceph/manifests/istio-virtualservice.yaml
index 2079b62..765179a 100644
--- a/infrastructure/rook-ceph/manifests/istio-virtualservice.yaml
+++ b/infrastructure/rook-ceph/manifests/istio-virtualservice.yaml
@@ -9,13 +9,9 @@ spec:
   gateways:
     - istio-system/edge
   http:
-    - headers:
-        request:
-          set:
-            x-forwarded-proto: https
-      timeout: 3600s
+    - timeout: 3600s
       route:
         - destination:
             host: rook-ceph-mgr-dashboard.rook-ceph.svc.cluster.local
             port:
-              number: 7000
+              number: 8443