Fernet keys are rotated by the keystone deploy playbook every time

[Pierre Riteau]

When running deploy or reconfigure for Keystone, ansible/roles/keystone/tasks/deploy.yml calls init_fernet.yml, which runs /usr/bin/fernet-rotate.sh, which calls keystone-manage fernet_rotate.

This means that a token can become invalid if the operator runs deploy or reconfigure too often.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/666882

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/666882
Committed: https://git.openstack.org/cgit/openstack/kolla-ansible/commit/?id=09e29d0db9b895b97470c9c8a60442b980a3eb3c
Submitter: Zuul
Branch: master

commit 09e29d0db9b895b97470c9c8a60442b980a3eb3c
Author: Mark Goddard <email address hidden>
Date: Fri Jun 21 16:52:18 2019 +0100

    Don't rotate keystone fernet keys during deploy

    When running deploy or reconfigure for Keystone,
    ansible/roles/keystone/tasks/deploy.yml calls init_fernet.yml,
    which runs /usr/bin/fernet-rotate.sh, which calls keystone-manage
    fernet_rotate.

    This means that a token can become invalid if the operator runs
    deploy or reconfigure too often.

    This change splits out fernet-push.sh from the fernet-rotate.sh
    script, then calls fernet-push.sh after the fernet bootstrap
    performed in deploy.

    Change-Id: I824857ddfb1dd026f93994a4ac8db8f80e64072e
    Closes-Bug: #1833729

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/stein
Review: https://review.opendev.org/669132

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/669132
Committed: https://git.openstack.org/cgit/openstack/kolla-ansible/commit/?id=61406fe9251f63c05c5423511a8d480c8d7d6433
Submitter: Zuul
Branch: stable/stein

commit 61406fe9251f63c05c5423511a8d480c8d7d6433
Author: Mark Goddard <email address hidden>
Date: Fri Jun 21 16:52:18 2019 +0100

    Don't rotate keystone fernet keys during deploy

    When running deploy or reconfigure for Keystone,
    ansible/roles/keystone/tasks/deploy.yml calls init_fernet.yml,
    which runs /usr/bin/fernet-rotate.sh, which calls keystone-manage
    fernet_rotate.

    This means that a token can become invalid if the operator runs
    deploy or reconfigure too often.

    This change splits out fernet-push.sh from the fernet-rotate.sh
    script, then calls fernet-push.sh after the fernet bootstrap
    performed in deploy.

    Change-Id: I824857ddfb1dd026f93994a4ac8db8f80e64072e
    Closes-Bug: #1833729
    (cherry picked from commit 09e29d0db9b895b97470c9c8a60442b980a3eb3c)

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/rocky
Review: https://review.opendev.org/670288

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/queens
Review: https://review.opendev.org/670289

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/670289
Committed: https://git.openstack.org/cgit/openstack/kolla-ansible/commit/?id=c68cc2c66392e3fe791fc1aba95d20ac5becbc37
Submitter: Zuul
Branch: stable/queens

commit c68cc2c66392e3fe791fc1aba95d20ac5becbc37
Author: Mark Goddard <email address hidden>
Date: Fri Jun 21 16:52:18 2019 +0100

    Don't rotate keystone fernet keys during deploy

    When running deploy or reconfigure for Keystone,
    ansible/roles/keystone/tasks/deploy.yml calls init_fernet.yml,
    which runs /usr/bin/fernet-rotate.sh, which calls keystone-manage
    fernet_rotate.

    This means that a token can become invalid if the operator runs
    deploy or reconfigure too often.

    This change splits out fernet-push.sh from the fernet-rotate.sh
    script, then calls fernet-push.sh after the fernet bootstrap
    performed in deploy.

    Change-Id: I824857ddfb1dd026f93994a4ac8db8f80e64072e
    Closes-Bug: #1833729
    (cherry picked from commit 09e29d0db9b895b97470c9c8a60442b980a3eb3c)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/670288
Committed: https://git.openstack.org/cgit/openstack/kolla-ansible/commit/?id=099417d8a83dbbd85c6b0d07a00184ac35e5ba55
Submitter: Zuul
Branch: stable/rocky

commit 099417d8a83dbbd85c6b0d07a00184ac35e5ba55
Author: Mark Goddard <email address hidden>
Date: Fri Jun 21 16:52:18 2019 +0100

    Don't rotate keystone fernet keys during deploy

    When running deploy or reconfigure for Keystone,
    ansible/roles/keystone/tasks/deploy.yml calls init_fernet.yml,
    which runs /usr/bin/fernet-rotate.sh, which calls keystone-manage
    fernet_rotate.

    This means that a token can become invalid if the operator runs
    deploy or reconfigure too often.

    This change splits out fernet-push.sh from the fernet-rotate.sh
    script, then calls fernet-push.sh after the fernet bootstrap
    performed in deploy.

    Change-Id: I824857ddfb1dd026f93994a4ac8db8f80e64072e
    Closes-Bug: #1833729
    (cherry picked from commit 09e29d0db9b895b97470c9c8a60442b980a3eb3c)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/kolla-ansible 8.0.0.0rc2 release candidate.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/kolla-ansible 6.2.2 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/kolla-ansible 7.1.2 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/kolla-ansible 9.0.0.0rc1 release candidate.