openstack-ansible-os_keystone/primary-container-rebuild-a2f4d7f33d66c843.yaml at 0a24c61e3e65e126691577c9b2843a7d9f448301 - openstack-ansible-os_keystone - OpenDev: Free Software Needs Free Tools

openstack/openstack-ansible-os_keystone

Logan V b3425781ec Rebuild credential-key repo during keystone[0] rebuild

When the first Keystone container is rebult in an existing environment,
the credential key repository is overwritten with new keys and the
existing keys are overwritten on the other infrastructure hosts without
any migration taking place. This results in an irrevocable loss of
the keys used to encrypt the credentials.

Now we will collect keys from any existing credential keys on the other
containers and use them to rebuild the credential-key repo on the primary
container before performing a key migration and rotation.

If no keys are found on the other containers, we will perform a
credential_setup on the primary container and sync the keys, just
as we would have before.

Closes-Bug: #1667960
Change-Id: Ic616d397574573629273838fbf68ea3f6bdb0468

2017-03-04 02:46:39 +00:00

6 lines

225 B

YAML

Raw Blame History

 ---
 critical:
   - A bug that caused the Keystone credential keys to be lost when the playbook
     is run during a rebuild of the first Keystone container has been fixed.
     Please see launchpad bug 1667960 for more details.