Document Memcache server needed system time setting

[Maru Newby]

Using python-memcached, memcache get() calls do not appear to respect the expiry time submitted to set(). The memcache token backend appears to assume that keys will not be returned after the expiry passed to set, so token life is effectively unlimited when using this backend.

The fake memcache client in test_backend_memcache honours the expiry provided to set(), so this bug is effectively masked in testing.

[Joseph Heck (heckj)]

Maru - Is this a bug in keystone, a bug in python-memcache, or a bug in how we're using python-memcache?

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/9525

[Maru Newby (maru)]

I've discovered that the problem I was seeing with memcache returning keys that should be expired is due to a timezone issue. Setting token expiry to 20m and then repeatedly checking if keystone would report a token as expired discovered that expiry occurred after 5 hours 20m, consistent with a -5h UTC offset - EST. It appears that memcache is configured to use the system timezone, and if that timezone is not utc (what keystone uses), the skew will result in tokens not expiring as expected.

This bug is still valid, though documenting the requirement that the memcache server's system clock be set to utc might be preferable to the proposed fix.

[Maru Newby (maru)]

I've submitted a doc patch, but after consideration I would like to see the code change go in (if not now, in the future). auth_token is already performing explicit expiry checks rather than relying on implicit memcache expiry, and it would seem to make sense that the token backend rely on implicit expiry as well.

The complication is that anybody using the memcache token backend will have to bounce their memcache host(s) before upgrading to the token backend updated to use explicit expiry.

Joe: Thoughts? I suppose the doc change can go in for Folsom and the code change can follow eventually.

[Thierry Carrez (ttx)]

Doc change is under review at: https://review.openstack.org/#/c/12605/

Maru: could you create a separate bug to track the additional change ? Then we can target it speraately from the doc fix...