88fe59f04d
This change makes the use of fernet tokens production ready. The changes are
as follows:
* Ensures that the keys are rotated on every playbook execution
* Removes the need to sync keys back to a deployment host when distributing
them to other keystone hosts.
* Creates an autonomous key rotation process that can rotate on the following
intervals [reboot, yearly, annually, monthly, weekly, daily, hourly] to all
hosts from any keystone fernet host.
* Fixes the section in `keystone.conf` which was named "fernet_key" instead
of "fernet_token".
Change-Id: I50f6a852930728631f5c681a8aa0f1321d7424ac
Related-Bug: #1463569
Closes-Bug: #1468256
99 lines
2.8 KiB
Django/Jinja
99 lines
2.8 KiB
Django/Jinja
# {{ ansible_managed }}
|
|
|
|
[DEFAULT]
|
|
verbose = {{ verbose }}
|
|
debug = {{ debug }}
|
|
admin_token = {{ keystone_auth_admin_token }}
|
|
{% if keystone_public_endpoint is defined %}
|
|
public_endpoint = {{ keystone_public_endpoint }}
|
|
{% endif %}
|
|
admin_endpoint = {{ keystone_service_adminuri }}
|
|
fatal_deprecations = {{ keystone_fatal_deprecations }}
|
|
|
|
{% if keystone_ssl_enabled == true and keystone_secure_proxy_ssl_header is defined %}
|
|
secure_proxy_ssl_header = {{ keystone_secure_proxy_ssl_header }}
|
|
{% endif %}
|
|
|
|
log_file = keystone.log
|
|
log_dir = /var/log/keystone
|
|
rpc_backend = {{ keystone_rpc_backend }}
|
|
|
|
{% if 'memcache' in keystone_token_driver and 'fernet' not in keystone_token_provider %}
|
|
[memcache]
|
|
servers = {{ keystone_memcached_servers }}
|
|
max_compare_and_set_retry = {{ keystone_memcached_max_compare_and_set_retry }}
|
|
{% endif %}
|
|
|
|
{% if keystone_cache_backend_argument is defined %}
|
|
[cache]
|
|
backend = dogpile.cache.memcached
|
|
backend_argument = {{ keystone_cache_backend_argument }}
|
|
config_prefix = cache.keystone
|
|
distributed_lock = True
|
|
expiration_time = {{ keystone_cache_expiration_time }}
|
|
enabled = true
|
|
{% endif %}
|
|
|
|
|
|
[revoke]
|
|
caching = true
|
|
driver = {{ keystone_revocation_driver }}
|
|
expiration_buffer = {{ keystone_revocation_expiration_buffer }}
|
|
cache_time = {{ keystone_revocation_cache_time }}
|
|
|
|
|
|
[auth]
|
|
methods = {{ keystone_auth_methods }}
|
|
|
|
|
|
[database]
|
|
connection = mysql://{{ keystone_galera_user }}:{{ keystone_container_mysql_password }}@{{ keystone_galera_address }}/{{ keystone_galera_database }}?charset=utf8
|
|
idle_timeout = {{ keystone_database_idle_timeout }}
|
|
min_pool_size = {{ keystone_database_min_pool_size }}
|
|
max_pool_size = {{ keystone_database_max_pool_size }}
|
|
pool_timeout = {{ keystone_database_pool_timeout }}
|
|
|
|
|
|
[fernet_tokens]
|
|
key_repository = {{ keystone_fernet_tokens_key_repository }}
|
|
max_active_keys = {{ keystone_fernet_tokens_max_active_keys }}
|
|
|
|
|
|
[identity]
|
|
driver = {{ keystone_identity_driver }}
|
|
{% if keystone_ldap is defined %}
|
|
domain_config_dir = {{ keystone_ldap_domain_config_dir }}
|
|
domain_specific_drivers_enabled = True
|
|
{% endif %}
|
|
|
|
|
|
[assignment]
|
|
driver = {{ keystone_assignment_driver }}
|
|
|
|
|
|
[resource]
|
|
cache_time = {{ keystone_resource_cache_time }}
|
|
caching = true
|
|
driver = {{ keystone_resource_driver }}
|
|
|
|
|
|
[token]
|
|
enforce_token_bind = permissive
|
|
expiration = {{ keystone_token_expiration }}
|
|
caching = true
|
|
cache_time = {{ keystone_token_cache_time }}
|
|
provider = {{ keystone_token_provider }}
|
|
{% if 'fernet' not in keystone_token_provider %}
|
|
driver = {{ keystone_token_driver }}
|
|
{% endif %}
|
|
|
|
[eventlet_server]
|
|
admin_bind_host = {{ keystone_bind_address }}
|
|
admin_port = {{ keystone_admin_port }}
|
|
public_port = {{ keystone_service_port }}
|
|
|
|
[oslo_messaging_rabbit]
|
|
rabbit_hosts = {{ rabbitmq_servers }}
|
|
rabbit_userid = {{ rabbitmq_userid }}
|
|
rabbit_password = {{ rabbitmq_password }}
|