Keystone token table filling up

[Mathias Ewald]

I noticed my keystone.token table filling up to a point where the entire cloud started responding slowly. I tracked it down the following missing pieces in keystone.conf:

[memcache]
servers = 10.242.7.10:11211,10.242.7.11:11211,10.242.7.12:11211

[token]
driver = memcache
caching = True

After adding this, the token table stayed empty.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/385586

[Jeffrey Zhang (jeffrey4l)]

i prefer not to use memcached as default.

it is not persistent. And for mysql token driver, there is a `keystone-manage token_flush` to remove the overdue token.

[Jeffrey Zhang (jeffrey4l)]

i do not think this is critical. this is how mysql driver works and why keystone-mange token_flush exist.

[Steven Dake (sdake)]

Jeffrey,

I have removed it from Newton 3.0.0 for now. If we need this change in 3.0.1 I think we should reconsider it then.

To me this looks like operator error WRT how the software is designed (which doesn't seem all that good if it makes the cloud crawl under heavy use)

[Mohammed Naser (mnaser)]

I would like to propose for us to switch to Fernet tokens. This will remove the issues with databases filling up and get Kolla to deploy something that is not deprecated.

https://docs.openstack.org/releasenotes/keystone/ocata.html

The default in Ocata is Fernet so I think it's time to move to it.

[Mohammed Naser (mnaser)]

I can pick up the work behind this if you'd like (to get us to move to fernet tokens) if that's okay with you, Mathias.

[Mathias Ewald (mewald)]

That would be great, thank you!

Mohammed Naser <email address hidden> schrieb am Fr., 17. März 2017,
13:01:

> I can pick up the work behind this if you'd like (to get us to move to
> fernet tokens) if that's okay with you, Mathias.
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/1632811
>
> Title:
> Keystone token table filling up
>
> Status in kolla:
> In Progress
>
> Bug description:
> I noticed my keystone.token table filling up to a point where the
> entire cloud started responding slowly. I tracked it down the
> following missing pieces in keystone.conf:
>
> [memcache]
> servers = 10.242.7.10:11211,10.242.7.11:11211,10.242.7.12:11211
>
> [token]
> driver = memcache
> caching = True
>
> After adding this, the token table stayed empty.
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/kolla/+bug/1632811/+subscriptions
>

[Vladislav Belogrudov (vlad-belogrudov)]

any progress? :)

Is setting keystone_token_provider to 'fernet' enough for the fix?

[OpenStack Infra (hudson-openstack)]

Change abandoned by Mathias Ewald (<email address hidden>) on branch: master
Review: https://review.openstack.org/385586