keystone should clean up expired tokens

[Andrew Bogott]

As of Icehouse, at least, keystone doesn't ever clean up expired tokens. After a few years, my keystone ridiculously huge, causing query timeouts and such.

[Andrew Bogott (andrewbogott)]

um... that should read 'my keystone database is ridiculously huge'

[Dolph Mathews (dolph)]

Docs:

  http://docs.openstack.org/admin-guide-cloud/content/flushing-expired-tokens-from-token-database-table.html

In addition, Fernet tokens, introduced in Kilo, do not need to be persisted to the database, and will leave your token table completely empty:

  http://docs.openstack.org/developer/keystone/configuration.html#uuid-pki-pkiz-or-fernet