524868c632
This adds the docker aspects of fernet key bootstrapping as well as distributed key rotation. - Bootstrapping is handled in the same way as keystone bootstrap. - A new keystone-fernet and keystone-ssh container is created to allow the nodes to communicate with each other (taken from nova-ssh). - The keystone-fernet is a keystone container with crontab installed. This will handle key rotations through keystone-manage and trigger an rsync to push new tokens to other nodes. The Ansible component is implemented in: https://review.openstack.org/#/c/349366 Change-Id: Id610e00e8c63c7f1bc0974c0aa1b3f44c18e1019 Partially-Implements: blueprint keystone-fernet-token Partially-Implements: blueprint third-party-plugin-support
21 lines
507 B
Bash
21 lines
507 B
Bash
#!/bin/bash
|
|
|
|
if [[ ! -L /dev/log ]]; then
|
|
ln -sf /var/lib/kolla/heka/log /dev/log
|
|
fi
|
|
|
|
SSH_HOST_KEY_TYPES=( "rsa" "dsa" "ecdsa" "ed25519" )
|
|
|
|
for key_type in ${SSH_HOST_KEY_TYPES[@]}; do
|
|
KEY_PATH=/etc/ssh/ssh_host_${key_type}_key
|
|
if [[ ! -f "${KEY_PATH}" ]]; then
|
|
ssh-keygen -q -t ${key_type} -f ${KEY_PATH} -N ""
|
|
fi
|
|
done
|
|
|
|
mkdir -p /var/lib/keystone/.ssh
|
|
|
|
if [[ $(stat -c %U:%G /var/lib/keystone/.ssh) != "keystone:keystone" ]]; then
|
|
sudo chown keystone: /var/lib/keystone/.ssh
|
|
fi
|