b45679f122
During a deploy, if keystone Fernet key rotation happens before the keystone container starts, the rotation may fail with 'permission denied'. This happens because config.json for Keystone sets the permissions for /etc/keystone/fernet-keys. This change fixes the issue by also setting the permissions for /etc/keystone/fernet-keys in config.json for keystone-fernet and keystone-ssh. Change-Id: I561e4171d14dcaad8a2a9a36ccab84a670daa904 Closes-Bug: #1888512
25 lines
636 B
Django/Jinja
25 lines
636 B
Django/Jinja
{
|
|
"command": "/usr/sbin/sshd -D",
|
|
"config_files": [
|
|
{
|
|
"source": "{{ container_config_directory }}/sshd_config",
|
|
"dest": "/etc/ssh/sshd_config",
|
|
"owner": "root",
|
|
"perm": "0600"
|
|
},
|
|
{
|
|
"source": "{{ container_config_directory }}/id_rsa.pub",
|
|
"dest": "/var/lib/keystone/.ssh/authorized_keys",
|
|
"owner": "keystone",
|
|
"perm": "0600"
|
|
}
|
|
],
|
|
"permissions": [
|
|
{
|
|
"path": "/etc/keystone/fernet-keys",
|
|
"owner": "keystone:keystone",
|
|
"perm": "0770"
|
|
}
|
|
]
|
|
}
|