openstack/keystone
Code Issues Proposed changes

Merge "Add release note for fernet tokens"

Browse Source
This commit is contained in:
Jenkins 2016-11-01 16:21:59 +00:00 committed by Gerrit Code Review
commit 748eb41904
1 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
releasenotes/notes/make-fernet-the-default-token-provider-dbe88b552a936a05.yaml Normal file
View File

@ -0,0 +1,21 @@
---
upgrade:
- The default token provider has switched from UUID
to Fernet. Please note that Fernet requires a
key repository to be in place prior to running Ocata.
This can be done using ``keystone-manage fernet_setup``.
Documentation can be found `here <http://docs.openstack.org/developer/keystone/man/keystone-manage.html>`_.
In addition, for multi-node deployments, it is imperative that
a key distribution process be in use before upgrading. Once
a key repository has been created it should be distributed
to all keystone nodes in the deployment. This ensures that
each keystone node will be able to validate tokens issued
across the deployment. If you do not wish to switch token
formats, you will need to explicitly set UUID as the token
provider for each node in the deployment using
``[token] provider = uuid`` in your ``keystone.conf``.
critical:
- If upgrading to Fernet tokens, you must have a key
repository and key distribution mechanism in place.
Otherwise token validation may not work. Please see
the upgrade section for more details.