commit d66e95d1d96c9f5aee52740df53d6e784c7b8194
Author: Mark Goddard <email address hidden>
Date: Thu May 16 17:26:45 2019 +0100
Fix keystone fernet key rotation scheduling
Right now every controller rotates fernet keys. This is nice because
should any controller die, we know the remaining ones will rotate the
keys. However, we are currently over-rotating the keys.
When we over rotate keys, we get logs like this:
This is not a recognized Fernet token <token> TokenNotFound
Most clients can recover and get a new token, but some clients (like
Nova passing tokens to other services) can't do that because it doesn't
have the password to regenerate a new token.
With three controllers, in crontab in keystone-fernet we see the once a day
correctly staggered across the three controllers:
Rotation is based on pushing out a staging key, so should any server
start using that key, other servers will consider that valid. Then each
server in turn starts using the staging key, each in term demoting the
existing primary key to a secondary key. Eventually you prune the
secondary keys when there is no token in the wild that would need to be
decrypted using that key. So this all makes sense.
This change adds new variables for fernet_token_allow_expired_window and
fernet_key_rotation_interval, so that we can correctly calculate the
correct number of active keys. We now set the default rotation interval
so as to minimise the number of active keys to 3 - one primary, one
secondary, one buffer.
This change also fixes the fernet cron job generator, which was broken
in the following cases:
* requesting an interval of more than 1 day resulted in no jobs
* requesting an interval of more than 60 minutes, unless an exact
multiple of 60 minutes, resulted in no jobs
It should now be possible to request any interval up to a week divided
by the number of hosts.
Change-Id: I10c82dc5f83653beb60ddb86d558c5602153341a
Closes-Bug: #1809469
(cherry picked from commit 6c1442c385450004dd253f3f464fe4336194be99)
Reviewed: https:/ /review. opendev. org/666093 /git.openstack. org/cgit/ openstack/ kolla-ansible/ commit/ ?id=d66e95d1d96 c9f5aee52740df5 3d6e784c7b8194
Committed: https:/
Submitter: Zuul
Branch: stable/rocky
commit d66e95d1d96c9f5 aee52740df53d6e 784c7b8194
Author: Mark Goddard <email address hidden>
Date: Thu May 16 17:26:45 2019 +0100
Fix keystone fernet key rotation scheduling
Right now every controller rotates fernet keys. This is nice because
should any controller die, we know the remaining ones will rotate the
keys. However, we are currently over-rotating the keys.
When we over rotate keys, we get logs like this:
This is not a recognized Fernet token <token> TokenNotFound
Most clients can recover and get a new token, but some clients (like
Nova passing tokens to other services) can't do that because it doesn't
have the password to regenerate a new token.
With three controllers, in crontab in keystone-fernet we see the once a day
correctly staggered across the three controllers:
ssh ctrl1 sudo cat /etc/kolla/ keystone- fernet/ crontab fernet- rotate. sh keystone- fernet/ crontab fernet- rotate. sh keystone- fernet/ crontab fernet- rotate. sh
0 0 * * * /usr/bin/
ssh ctrl2 sudo cat /etc/kolla/
0 8 * * * /usr/bin/
ssh ctrl3 sudo cat /etc/kolla/
0 16 * * * /usr/bin/
Currently with three controllers we have this keystone config:
[token] expired_ window = 172800 (this is the keystone default)
expiration = 86400 (although, keystone default is one hour)
allow_
[fernet_tokens]
max_active_keys = 4
Currently, kolla-ansible configures key rotation according to the following:
This means we rotate keys more quickly the more hosts we have, which doesn't
make much sense.
Keystone docs state:
For details see: /docs.openstack .org/keystone/ stein/admin/ fernet- token-faq. html
https:/
Rotation is based on pushing out a staging key, so should any server
start using that key, other servers will consider that valid. Then each
server in turn starts using the staging key, each in term demoting the
existing primary key to a secondary key. Eventually you prune the
secondary keys when there is no token in the wild that would need to be
decrypted using that key. So this all makes sense.
This change adds new variables for fernet_ token_allow_ expired_ window and key_rotation_ interval, so that we can correctly calculate the
fernet_
correct number of active keys. We now set the default rotation interval
so as to minimise the number of active keys to 3 - one primary, one
secondary, one buffer.
This change also fixes the fernet cron job generator, which was broken
in the following cases:
* requesting an interval of more than 1 day resulted in no jobs
* requesting an interval of more than 60 minutes, unless an exact
multiple of 60 minutes, resulted in no jobs
It should now be possible to request any interval up to a week divided
by the number of hosts.
Change-Id: I10c82dc5f83653 beb60ddb86d558c 5602153341a 4dd253f3f464fe4 336194be99)
Closes-Bug: #1809469
(cherry picked from commit 6c1442c38545000