Use redis to store/rotate fernet keys

[Steve Martinelli]

Currently the only option for fernet keys is to store them on a file system, and replicate and rotate them using tools such as rsync.

It would be nice to use something like redis to store these keys instead.

[Dolph Mathews (dolph)]

Why Redis, specifically? That would have all the same security issues as storing them in SQL.

[Guang Yee (guang-yee)]

Dolph, I agree, Redis would have the same security issues. We are working on a POC to see if those keys can be managed by Barbican. Will update our findings once we have the POC completed.

[David Stanek (dstanek)]

I agree with Dolph and Guang here. There are too many things we would need to do to make this secure. We already hash user passwords that are stored in the database so following suite we would probably encrypt the keys. That means we have encryption keys to decrypt the fernet keys on disk anyway.

[Launchpad Janitor (janitor)]

[Expired for OpenStack Identity (keystone) because there has been no activity for 60 days.]