openstack
/
tripleo-common
Code Issues Proposed changes

Merge "Do not rotate CephX secrets"

This commit is contained in:
Zuul 2020-05-28 04:45:29 +00:00 committed by Gerrit Code Review
parent 2b2abeed26 d1662ad411
commit 95b59aa26d
2 changed files with 10 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
tripleo_common/constants.py
View File

@ -153,6 +153,10 @@ DO_NOT_ROTATE_LIST = (
'KeystoneFernetKey0', 'KeystoneFernetKey0',
'KeystoneFernetKey1', 'KeystoneFernetKey1',
'KeystoneFernetKeys', 'KeystoneFernetKeys',
'CephClientKey',
'CephClusterFSID',
'CephManilaClientKey',
'CephRgwKey',
) )
PLAN_NAME_PATTERN = '^[a-zA-Z0-9-]+$' PLAN_NAME_PATTERN = '^[a-zA-Z0-9-]+$'

13
tripleo_common/utils/passwords.py
View File

@ -51,13 +51,12 @@ def generate_passwords(stack_env=None,
if (stack_env and name in stack_env.get('parameter_defaults', {}) and if (stack_env and name in stack_env.get('parameter_defaults', {}) and
not rotate_passwords): not rotate_passwords):
passwords[name] = stack_env['parameter_defaults'][name] passwords[name] = stack_env['parameter_defaults'][name]
elif name.startswith("Ceph"): elif name in ('CephClientKey', 'CephManilaClientKey', 'CephRgwKey'):
if name == "CephClusterFSID": # CephX keys aren't random strings
# The FSID must be a UUID passwords[name] = create_cephx_key()
passwords[name] = six.text_type(uuid.uuid4()) elif name == "CephClusterFSID":
else: # The FSID must be a UUID
# CephX keys aren't random strings passwords[name] = six.text_type(uuid.uuid4())
passwords[name] = create_cephx_key()
# Since by default passlib.pwd.genword uses all digits and ascii upper # Since by default passlib.pwd.genword uses all digits and ascii upper
# & lowercase letters, it provides ~5.95 entropy per character. # & lowercase letters, it provides ~5.95 entropy per character.
# Make the length of the default authkey 4096 bytes, which should give # Make the length of the default authkey 4096 bytes, which should give