ba8c27f554
Currently we check the age of the primary Fernet key on Keystone startup, and fail if it is older than the rotation interval. While this may seem sensible, there are various reasons why the key may be older than this: * if the rotation interval is not a factor of the number of seconds in a week, the rotation schedule will be lumpy, with the last rotation being up to twice the nominal rotation interval * if a keystone host is unavailable at its scheduled rotation time, rotation will not happen. This may happen multiple times We could do several things to avoid this issue: 1. remove the check on the age of the key 2. multiply the rotation interval by some factor to determine the allowed key age This change goes for the more simple option 1. It also cleans up some terminology in the keystone-startup.sh script. Closes-Bug: #1895723 Change-Id: I2c35f59ae9449cb1646e402e0a9f28ad61f918a8
9 lines
358 B
YAML
9 lines
358 B
YAML
---
|
|
fixes:
|
|
- |
|
|
Fixes an issue with Keystone startup when Fernet key rotation does not
|
|
occur within the configured interval. This may happen due to one of the
|
|
Keystone hosts being down at the scheduled time of rotation, or due to
|
|
uneven intervals between cron jobs. `LP#1895723
|
|
<https://bugs.launchpad.net/kolla-ansible/+bug/1895723>`__
|