Keystoneclient revocation list is not multi-thread/process safe

[James E. Blair]

As illustrated by this traceback in nova-api:

2013-12-16 17:10:42.986 25416 TRACE keystoneclient.middleware.auth_token Traceback (most recent call last):
2013-12-16 17:10:42.986 25416 TRACE keystoneclient.middleware.auth_token File "/opt/stack/new/python-keystoneclient/keystoneclient/middleware/auth_token.py", line 818, in _validate_user_token
2013-12-16 17:10:42.986 25416 TRACE keystoneclient.middleware.auth_token verified = self.verify_signed_token(user_token)
2013-12-16 17:10:42.986 25416 TRACE keystoneclient.middleware.auth_token File "/opt/stack/new/python-keystoneclient/keystoneclient/middleware/auth_token.py", line 1179, in verify_signed_token
2013-12-16 17:10:42.986 25416 TRACE keystoneclient.middleware.auth_token if self.is_signed_token_revoked(signed_text):
2013-12-16 17:10:42.986 25416 TRACE keystoneclient.middleware.auth_token File "/opt/stack/new/python-keystoneclient/keystoneclient/middleware/auth_token.py", line 1139, in is_signed_token_revoked
2013-12-16 17:10:42.986 25416 TRACE keystoneclient.middleware.auth_token revocation_list = self.token_revocation_list
2013-12-16 17:10:42.986 25416 TRACE keystoneclient.middleware.auth_token File "/opt/stack/new/python-keystoneclient/keystoneclient/middleware/auth_token.py", line 1230, in token_revocation_list
2013-12-16 17:10:42.986 25416 TRACE keystoneclient.middleware.auth_token self._token_revocation_list = jsonutils.loads(f.read())
2013-12-16 17:10:42.986 25416 TRACE keystoneclient.middleware.auth_token File "/opt/stack/new/python-keystoneclient/keystoneclient/openstack/common/jsonutils.py", line 168, in loads
2013-12-16 17:10:42.986 25416 TRACE keystoneclient.middleware.auth_token return json.loads(s)
2013-12-16 17:10:42.986 25416 TRACE keystoneclient.middleware.auth_token File "/usr/lib/python2.7/json/__init__.py", line 326, in loads
2013-12-16 17:10:42.986 25416 TRACE keystoneclient.middleware.auth_token return _default_decoder.decode(s)
2013-12-16 17:10:42.986 25416 TRACE keystoneclient.middleware.auth_token File "/usr/lib/python2.7/json/decoder.py", line 366, in decode
2013-12-16 17:10:42.986 25416 TRACE keystoneclient.middleware.auth_token obj, end = self.raw_decode(s, idx=_w(s, 0).end())
2013-12-16 17:10:42.986 25416 TRACE keystoneclient.middleware.auth_token File "/usr/lib/python2.7/json/decoder.py", line 384, in raw_decode
2013-12-16 17:10:42.986 25416 TRACE keystoneclient.middleware.auth_token raise ValueError("No JSON object could be decoded")
2013-12-16 17:10:42.986 25416 TRACE keystoneclient.middleware.auth_token ValueError: No JSON object could be decoded

This line performs a non-atomic file operation on a file that can have multiple readers:

http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/middleware/auth_token.py?id=8339aec3e86fde7c6e211ad26dd12892a8847e78#n1244

[Chmouel Boudjnah (chmouel)]

we probably want to write to a temporary file, flush and rename it to the revocacation_file_name

[Chmouel Boudjnah (chmouel)]

worked on https://review.openstack.org/#/c/62770/

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/62770
Committed: https://git.openstack.org/cgit/openstack/python-keystoneclient/commit/?id=8acc3b45868096c27ed43b22f5fa1b2d9aec38f4
Submitter: Jenkins
Branch: master

commit 8acc3b45868096c27ed43b22f5fa1b2d9aec38f4
Author: Chmouel Boudjnah <email address hidden>
Date: Tue Dec 17 23:05:12 2013 +0100

    Rename instead of writing directly to revoked file

    Make the operation more atomic with multiple writers.

    Closes-Bug: 1261554
    Change-Id: I990a2ba28d9a2a1d01300dcd33266956d059afa3