OBJ: add ca_bundle option in obj plugin and nixlbench

benchmark/kvbench/commands/args.py

@@ -264,6 +264,11 @@ def nixl_bench_args(func):
         type=str,
         help="Required checksum type for S3 backend [supported, required] (only used with OBJ backend)",
     )(func)
+    func = click.option(
+        "--obj_ca_bundle",
+        type=str,
+        help="Path to CA bundle for S3 backend (only used with OBJ backend)",
+    )(func)
     return func
 
 

benchmark/nixlbench/src/utils/utils.cpp

@@ -120,6 +120,7 @@ DEFINE_string(obj_endpoint_override, "", "Endpoint override for S3 backend");
 DEFINE_string(obj_req_checksum,
               XFERBENCH_OBJ_REQ_CHECKSUM_SUPPORTED,
               "Required checksum for S3 backend [supported, required]");
+DEFINE_string(obj_ca_bundle, "", "Path to CA bundle for S3 backend");
 
 // HF3FS options - only used when backend is HF3FS
 DEFINE_int32(hf3fs_iopool_size, 64, "Size of io memory pool");
@@ -169,6 +170,7 @@ std::string xferBenchConfig::obj_region = "";
 bool xferBenchConfig::obj_use_virtual_addressing = false;
 std::string xferBenchConfig::obj_endpoint_override = "";
 std::string xferBenchConfig::obj_req_checksum = "";
+std::string xferBenchConfig::obj_ca_bundle = "";
 int xferBenchConfig::hf3fs_iopool_size = 0;
 
 int
@@ -235,6 +237,7 @@ xferBenchConfig::loadFromFlags() {
             obj_use_virtual_addressing = FLAGS_obj_use_virtual_addressing;
             obj_endpoint_override = FLAGS_obj_endpoint_override;
             obj_req_checksum = FLAGS_obj_req_checksum;
+            obj_ca_bundle = FLAGS_obj_ca_bundle;
 
             // Validate OBJ S3 scheme
             if (obj_scheme != XFERBENCH_OBJ_SCHEME_HTTP &&
@@ -412,6 +415,7 @@ xferBenchConfig::printConfig() {
                         obj_endpoint_override);
             printOption("OBJ S3 required checksum (--obj_req_checksum=[supported, required])",
                         obj_req_checksum);
+            printOption("OBJ S3 CA bundle (--obj_ca_bundle=cert-path)", obj_ca_bundle);
         }
 
         if (xferBenchConfig::isStorageBackend()) {

benchmark/nixlbench/src/utils/utils.h

@@ -166,6 +166,7 @@ class xferBenchConfig {
         static bool obj_use_virtual_addressing;
         static std::string obj_endpoint_override;
         static std::string obj_req_checksum;
+        static std::string obj_ca_bundle;
         static int hf3fs_iopool_size;
 
         static int

benchmark/nixlbench/src/worker/nixl/nixl_worker.cpp

@@ -192,6 +192,10 @@ xferBenchNixlWorker::xferBenchNixlWorker(int *argc, char ***argv, std::vector<st
             xferBenchConfig::obj_use_virtual_addressing ? "true" : "false";
         backend_params["req_checksum"] = xferBenchConfig::obj_req_checksum;
 
+        if (xferBenchConfig::obj_ca_bundle != "") {
+            backend_params["ca_bundle"] = xferBenchConfig::obj_ca_bundle;
+        }
+
         if (xferBenchConfig::obj_endpoint_override != "") {
             backend_params["endpoint_override"] = xferBenchConfig::obj_endpoint_override;
         }

src/plugins/obj/README.md

@@ -48,6 +48,7 @@ Backend parameters are passed as a key-value map (`nixl_b_params_t`) when creati
 | `region` | AWS region for the S3 service | `us-east-1` | No |
 | `use_virtual_addressing` | Use virtual-hosted-style addressing (`true`/`false`) | `false` | No |
 | `req_checksum` | Request checksum validation (`required`/`supported`) | - | No |
+| `ca_bundle` | path to a custom certificate bundle | - | No |
 
 \* If `access_key` and `secret_key` are not provided, the AWS SDK will attempt to use default credential providers (IAM roles, environment variables, credential files, etc.)
 
@@ -115,7 +116,8 @@ nixl_b_params_t params = {
     {"scheme", "http"},
     {"region", "us-east-1"},
     {"use_virtual_addressing", "false"},
-    {"req_checksum", "supported"}
+    {"req_checksum", "supported"},
+    {"ca_bundle", "/root/ca-certs/cacert.pem"}
 };
 agent.createBackend("obj", params);
 ```

src/plugins/obj/obj_s3_client.cpp

@@ -74,6 +74,9 @@ createClientConfiguration(nixl_b_params_t *custom_params) {
                                      "'. Must be 'required' or 'supported'");
     }
 
+    auto ca_bundle_it = custom_params->find("ca_bundle");
+    if (ca_bundle_it != custom_params->end()) config.caFile = ca_bundle_it->second;
+
     return config;
 }