524868c632
This adds the docker aspects of fernet key bootstrapping as well as distributed key rotation. - Bootstrapping is handled in the same way as keystone bootstrap. - A new keystone-fernet and keystone-ssh container is created to allow the nodes to communicate with each other (taken from nova-ssh). - The keystone-fernet is a keystone container with crontab installed. This will handle key rotations through keystone-manage and trigger an rsync to push new tokens to other nodes. The Ansible component is implemented in: https://review.openstack.org/#/c/349366 Change-Id: Id610e00e8c63c7f1bc0974c0aa1b3f44c18e1019 Partially-Implements: blueprint keystone-fernet-token Partially-Implements: blueprint third-party-plugin-support
12 lines
283 B
Bash
12 lines
283 B
Bash
#!/bin/bash
|
|
|
|
FERNET_SYNC=/usr/bin/fernet-node-sync.sh
|
|
FERNET_TOKEN_DIR="/etc/keystone/fernet-keys"
|
|
|
|
if [[ -f "${FERNET_SYNC}" ]]; then
|
|
${FERNET_SYNC}
|
|
fi
|
|
|
|
if [[ $(stat -c %U:%G ${FERNET_TOKEN_DIR}) != "keystone:keystone" ]]; then
|
|
chown keystone:keystone ${FERNET_TOKEN_DIR}
|
|
fi |