524868c632
This adds the docker aspects of fernet key bootstrapping as well as distributed key rotation. - Bootstrapping is handled in the same way as keystone bootstrap. - A new keystone-fernet and keystone-ssh container is created to allow the nodes to communicate with each other (taken from nova-ssh). - The keystone-fernet is a keystone container with crontab installed. This will handle key rotations through keystone-manage and trigger an rsync to push new tokens to other nodes. The Ansible component is implemented in: https://review.openstack.org/#/c/349366 Change-Id: Id610e00e8c63c7f1bc0974c0aa1b3f44c18e1019 Partially-Implements: blueprint keystone-fernet-token Partially-Implements: blueprint third-party-plugin-support
44 lines
1.2 KiB
Bash
44 lines
1.2 KiB
Bash
#!/bin/bash
|
|
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
set -x
|
|
|
|
USERNAME=$1
|
|
GROUP=$2
|
|
|
|
function fail_json {
|
|
echo '{"failed": true, "msg": "'$1'", "changed": true}'
|
|
exit 1
|
|
}
|
|
|
|
function exit_json {
|
|
echo '{"failed": false, "changed": '"${changed}"'}'
|
|
}
|
|
|
|
changed="false"
|
|
keystone_bootstrap=$(keystone-manage --config-file /etc/keystone/keystone.conf fernet_setup --keystone-user ${USERNAME} --keystone-group ${GROUP} 2>&1)
|
|
if [[ $? != 0 ]]; then
|
|
fail_json "${keystone_bootstrap}"
|
|
fi
|
|
|
|
changed=$(echo "${keystone_bootstrap}" | awk '
|
|
/Key repository is already initialized/ {count++}
|
|
END {
|
|
if (count == 1) changed="true"; else changed="false"
|
|
print changed
|
|
}'
|
|
)
|
|
|
|
exit_json
|