Re-distribute fernet keys when re-building the primary
Currently when re-building the keystone primary node, a new set
of fernet keys will be created as none exists, despite keys
existing on the secondary nodes.
This patch uses a similar approach to the credential key
distribution where other nodes are checked for keys if none exist
on the first play host. In this case an rsync is performed to
distribute the keys correctly before proceeding.
Change-Id: I92434276aef54805e5cee56e1d22821e11245fe4
(cherry picked from commit 47bd365532
)
This commit is contained in:
parent
bf9a75dd46
commit
e9e375123e
|
@ -18,6 +18,43 @@
|
|||
path: "{{ keystone_fernet_tokens_key_repository }}/0"
|
||||
register: _fernet_keys
|
||||
|
||||
- name: Check for fernet keys on all Keystone containers
|
||||
find:
|
||||
paths: "{{ keystone_fernet_tokens_key_repository }}"
|
||||
when: not _fernet_keys.stat.exists
|
||||
register: _fernet_key_list
|
||||
delegate_to: "{{ item }}"
|
||||
with_items: "{{ groups['keystone_all'] }}"
|
||||
|
||||
- name: Identify hosts with existing fernet keys
|
||||
set_fact:
|
||||
existing_fernet_hosts: >-
|
||||
{% set _var = [] -%}
|
||||
{% for result in _fernet_key_list.results -%}
|
||||
{% if result.files is defined and (result.files | length) > 0 -%}
|
||||
{% if _var.append(result.item) -%}{% endif -%}
|
||||
{% endif -%}
|
||||
{% endfor -%}
|
||||
{{ _var }}
|
||||
when: not _fernet_key_list is skipped
|
||||
|
||||
- name: Copy the fernet key repository to the primary
|
||||
command: >
|
||||
rsync -e 'ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no'
|
||||
-avz
|
||||
--delete
|
||||
{{ keystone_system_user_name }}@{{ existing_fernet_hosts[0] }}:{{ keystone_fernet_tokens_key_repository }}/
|
||||
{{ keystone_fernet_tokens_key_repository }}/
|
||||
become: yes
|
||||
become_user: "{{ keystone_system_user_name }}"
|
||||
changed_when: false
|
||||
register: _fernet_keys_shared
|
||||
when:
|
||||
- existing_fernet_hosts is defined
|
||||
- (existing_fernet_hosts | length) > 0
|
||||
tags:
|
||||
- skip_ansible_lint
|
||||
|
||||
- name: Create fernet keys for Keystone # noqa: no-changed-when
|
||||
command: >
|
||||
{{ keystone_bin }}/keystone-manage fernet_setup
|
||||
|
@ -25,7 +62,9 @@
|
|||
--keystone-group "{{ keystone_system_group_name }}"
|
||||
become: yes
|
||||
become_user: "{{ keystone_system_user_name }}"
|
||||
when: not _fernet_keys.stat.exists
|
||||
when:
|
||||
- not _fernet_keys.stat.exists
|
||||
- _fernet_keys_shared is skipped
|
||||
|
||||
- name: Rotate fernet keys for Keystone # noqa: no-changed-when
|
||||
command: >
|
||||
|
|
Loading…
Reference in New Issue