b3425781ec
When the first Keystone container is rebult in an existing environment, the credential key repository is overwritten with new keys and the existing keys are overwritten on the other infrastructure hosts without any migration taking place. This results in an irrevocable loss of the keys used to encrypt the credentials. Now we will collect keys from any existing credential keys on the other containers and use them to rebuild the credential-key repo on the primary container before performing a key migration and rotation. If no keys are found on the other containers, we will perform a credential_setup on the primary container and sync the keys, just as we would have before. Closes-Bug: #1667960 Change-Id: Ic616d397574573629273838fbf68ea3f6bdb0468
102 lines
3.8 KiB
YAML
102 lines
3.8 KiB
YAML
---
|
|
# Copyright 2016, Rackspace US, Inc.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
- name: Check if credential keys already exist
|
|
stat:
|
|
path: "{{ keystone_credential_key_repository }}/0"
|
|
register: _credential_keys
|
|
|
|
- name: Check for credential keys on all Keystone containers
|
|
find:
|
|
paths: "{{ keystone_credential_key_repository }}"
|
|
patterns: "^[0-9]+$"
|
|
use_regex: True
|
|
when: not _credential_keys.stat.exists
|
|
register: credential_key_list
|
|
delegate_to: "{{ item }}"
|
|
with_items: "{{ groups['keystone_all'] }}"
|
|
|
|
- name: Aggregate the collected file lists
|
|
set_fact:
|
|
existing_credential_keys: >-
|
|
{% set _var = [] -%}
|
|
{% for result in credential_key_list.results -%}
|
|
{% if result.files is defined -%}
|
|
{% for file in result.files -%}
|
|
{% if _var.append({'host': result.item, 'file': file.path}) -%}{% endif -%}
|
|
{% endfor -%}
|
|
{% endif -%}
|
|
{% endfor -%}
|
|
{{ _var }}
|
|
when: not credential_key_list | skipped
|
|
|
|
- name: Collect the existing keys from containers
|
|
slurp:
|
|
src: "{{ item.file }}"
|
|
delegate_to: "{{ item.host }}"
|
|
with_items: "{{ existing_credential_keys }}"
|
|
register: collected_existing_credential_keys
|
|
when: existing_credential_keys is defined
|
|
|
|
- name: Ensure the target directory exists on the master Keystone container
|
|
file:
|
|
path: "{{ keystone_credential_key_repository }}"
|
|
state: directory
|
|
owner: "{{ keystone_system_user_name }}"
|
|
group: "{{ keystone_system_group_name }}"
|
|
mode: "0700"
|
|
when: not collected_existing_credential_keys | skipped
|
|
|
|
- name: Drop the existing credential keys in the master Keystone container
|
|
copy:
|
|
content: "{{ item.1 | b64decode }}"
|
|
dest: "{{ keystone_credential_key_repository }}/{{ item.0 }}"
|
|
owner: "{{ keystone_system_user_name }}"
|
|
group: "{{ keystone_system_group_name }}"
|
|
mode: "0600"
|
|
when: not collected_existing_credential_keys | skipped
|
|
register: drop_existing_credential_keys
|
|
with_indexed_items: "{{ collected_existing_credential_keys.results | map(attribute='content') | list | unique }}"
|
|
|
|
- name: Create credential keys for Keystone
|
|
command: >
|
|
{{ keystone_bin }}/keystone-manage credential_setup
|
|
--keystone-user "{{ keystone_system_user_name }}"
|
|
--keystone-group "{{ keystone_system_group_name }}"
|
|
become: yes
|
|
become_user: "{{ keystone_system_user_name }}"
|
|
register: create_credential_keys
|
|
when:
|
|
- not _credential_keys.stat.exists
|
|
- not drop_existing_credential_keys | changed
|
|
|
|
- name: Ensure newest key is used for credential in Keystone
|
|
command: >
|
|
{{ keystone_bin }}/keystone-manage credential_migrate
|
|
--keystone-user "{{ keystone_system_user_name }}"
|
|
--keystone-group "{{ keystone_system_group_name }}"
|
|
become: yes
|
|
become_user: "{{ keystone_system_user_name }}"
|
|
when: create_credential_keys | skipped
|
|
|
|
- name: Rotate credential keys for Keystone
|
|
command: >
|
|
{{ keystone_bin }}/keystone-manage credential_rotate
|
|
--keystone-user "{{ keystone_system_user_name }}"
|
|
--keystone-group "{{ keystone_system_group_name }}"
|
|
become: yes
|
|
become_user: "{{ keystone_system_user_name }}"
|
|
when: create_credential_keys | skipped
|