ODF - Disable http trafic to S3 buckets (MCG/noobaa or Ceph RGW)

Issue

• How to disable insecure HTTP traffic to S3 buckets ?

• By default ODF Internal mode configures three routes for S3 access to noobaa or ceph rgw buckets

For ceph RGW , route ocs-storagecluster-cephobjectstore and ocs-storagecluster-cephobjectstore-secure

% oc get route
NAME                                        HOST/PORT                                                                       PATH   SERVICES                                           PORT         TERMINATION          WILDCARD

ocs-storagecluster-cephobjectstore          ocs-storagecluster-cephobjectstore-openshift-storage.apps.your_cluster                 rook-ceph-rgw-ocs-storagecluster-cephobjectstore   http         edge/Allow           None

ocs-storagecluster-cephobjectstore-secure   ocs-storagecluster-cephobjectstore-secure-openshift-storage.apps.your_cluster          rook-ceph-rgw-ocs-storagecluster-cephobjectstore   https        reencrypt/Redirect   None

For noobaa , route s3

% oc get route
NAME                                        HOST/PORT                                                                       PATH   SERVICES                                           PORT         TERMINATION          WILDCARD
s3                                          s3-openshift-storage.apps.your_cluster                                                 s3                                                 s3-https     reencrypt/Allow      None

• Is there a supported way to configure these route with insecureEdgeTerminationPolicy set to Redirect or None, or any other supported approach that satisfies the ocp4-pci-dss-4-0-routes-protected-by-tls compliance rule without impacting the intended ODF/Ceph RGW/Noobaa functionality ?

• The spec.tls.insecureEdgeTerminationPolicy is configured on each route as follows:

% oc get route ocs-storagecluster-cephobjectstore  -o yaml|grep -i insecure
    insecureEdgeTerminationPolicy: Allow

% oc get route ocs-storagecluster-cephobjectstore-secure  -o yaml|grep -i insecure
    insecureEdgeTerminationPolicy: Redirect

% oc get route s3 -o yaml|grep insecureEdgeTerminationPolicy
    insecureEdgeTerminationPolicy: Allow

Allow  = allows insecure HTTP access in addition to HTTPS
Redirect = forces HTTPS 
None = disallows insecure HTTP