commit 7e5e887eb38042a0679ec100ca5d4016c6efe2bc
Author: Shuicheng Lin <email address hidden>
Date: Wed Dec 11 16:37:03 2019 +0800
Audit local registry secret info when there is user update in keystone
local registry uses admin's username&password for authentication.
And admin's password could be changed by openstack client cmd. It will
cause auth info in secrets obsolete, and lead to invalid authentication
in keystone.
To keep secrets info updated, keystone event notification is enabled.
And event notification listener is added in sysinv. So when there is
user password change, a user update event will be sent out by keystone.
And sysinv will call function audit_local_registry_secrets to check
whether kubernetes secret info need be updated or not.
A periodic task is added also to ensure secrets are always synced, in
case notification is missed or there is failure in handle notification.
oslo_messaging is added to tox's requirements.txt to avoid tox failure.
The version is based on global-requirements.txt from Openstack Train.
Test:
Pass deployment and secrets could be updated automatically with new auth
info.
Pass host-swact in duplex mode.
We lack of info how LP1853093 was triggered by the user, but this patch
can address the issue that local registry secrets are not updated
accordingly after the password of "admin" is changed.
And this fix will help technically.
Reviewed: https:/ /review. opendev. org/707524 /git.openstack. org/cgit/ starlingx/ config/ commit/ ?id=7e5e887eb38 042a0679ec100ca 5d4016c6efe2bc
Committed: https:/
Submitter: Zuul
Branch: r/stx.2.0
commit 7e5e887eb38042a 0679ec100ca5d40 16c6efe2bc
Author: Shuicheng Lin <email address hidden>
Date: Wed Dec 11 16:37:03 2019 +0800
Audit local registry secret info when there is user update in keystone
local registry uses admin's username&password for authentication. registry_ secrets to check
And admin's password could be changed by openstack client cmd. It will
cause auth info in secrets obsolete, and lead to invalid authentication
in keystone.
To keep secrets info updated, keystone event notification is enabled.
And event notification listener is added in sysinv. So when there is
user password change, a user update event will be sent out by keystone.
And sysinv will call function audit_local_
whether kubernetes secret info need be updated or not.
A periodic task is added also to ensure secrets are always synced, in
case notification is missed or there is failure in handle notification.
oslo_messaging is added to tox's requirements.txt to avoid tox failure. requirements. txt from Openstack Train.
The version is based on global-
Test:
Pass deployment and secrets could be updated automatically with new auth
info.
Pass host-swact in duplex mode.
We lack of info how LP1853093 was triggered by the user, but this patch
can address the issue that local registry secrets are not updated
accordingly after the password of "admin" is changed.
And this fix will help technically.
Closes-Bug: 1853017 /review. opendev. org/707522 /review. opendev. org/707523 b989aa87e40506e 41d0bba0d59 d72efcbfcddcdff a567a26bad)
Closes-Bug: 1853093
Depends-On: https:/
Depends-On: https:/
Change-Id: I959b65288e0834
Signed-off-by: Shuicheng Lin <email address hidden>
(cherry picked from commit 8ab1e2d7c624f83