Page MenuHomePhabricator

Convert keystone from uuid tokens to fernet tokens
Closed, ResolvedPublic

Description

UUID tokens are 'deprecated in Pike' which means we should move off of them soon. Fernet tokens have some advantages.

https://docs.openstack.org/keystone/queens/admin/identity-tokens.html
https://docs.openstack.org/newton/admin-guide/identity-fernet-token-faq.html

I don't yet know what the upgrade path will look like for this, but I don't think that client code will need to be modified.

Event Timeline

Looks like uuid is still supported in Queens but removed in Rocky.

Change 570507 had a related patch set uploaded (by Andrew Bogott; owner: Andrew Bogott):
[operations/puppet@production] Keystone: set max_active_keys for fernet tokens

https://gerrit.wikimedia.org/r/570507

Change 570521 had a related patch set uploaded (by Andrew Bogott; owner: Andrew Bogott):
[operations/puppet@production] Keystone: rotate and sync fernet tokens

https://gerrit.wikimedia.org/r/570521

Change 570507 merged by Andrew Bogott:
[operations/puppet@production] Keystone: set max_active_keys for fernet tokens

https://gerrit.wikimedia.org/r/570507

Change 570521 merged by Andrew Bogott:
[operations/puppet@production] Keystone: rotate and sync fernet tokens

https://gerrit.wikimedia.org/r/570521

Change 570908 had a related patch set uploaded (by Andrew Bogott; owner: Andrew Bogott):
[operations/puppet@production] keystone key sync: update rsync remote path

https://gerrit.wikimedia.org/r/570908

Change 570908 merged by Andrew Bogott:
[operations/puppet@production] keystone key sync: update rsync remote path

https://gerrit.wikimedia.org/r/570908

Bstorm triaged this task as Medium priority.Feb 11 2020, 4:12 PM
Bstorm moved this task from Inbox to Doing on the cloud-services-team (Kanban) board.

Change 572413 had a related patch set uploaded (by Andrew Bogott; owner: Andrew Bogott):
[operations/puppet@production] keystone fernet key rotation: delete files during rsync

https://gerrit.wikimedia.org/r/572413

Change 572413 merged by Andrew Bogott:
[operations/puppet@production] keystone fernet key rotation: delete files during rsync

https://gerrit.wikimedia.org/r/572413

Change 572507 had a related patch set uploaded (by Andrew Bogott; owner: Andrew Bogott):
[operations/puppet@production] Keystone: switch from UUID tokens to fernet tokens

https://gerrit.wikimedia.org/r/572507

Change 572507 merged by Andrew Bogott:
[operations/puppet@production] Keystone: switch from UUID tokens to fernet tokens

https://gerrit.wikimedia.org/r/572507

Change 589876 had a related patch set uploaded (by Andrew Bogott; owner: Andrew Bogott):
[operations/puppet@production] Keystone: remove openstack::keystone::cleanup

https://gerrit.wikimedia.org/r/589876

Change 589877 had a related patch set uploaded (by Andrew Bogott; owner: Andrew Bogott):
[operations/puppet@production] openstack::keystone::cleanup: remove all timers

https://gerrit.wikimedia.org/r/589877

Change 589877 merged by Andrew Bogott:
[operations/puppet@production] openstack::keystone::cleanup: remove all timers

https://gerrit.wikimedia.org/r/589877

Change 589876 merged by Andrew Bogott:
[operations/puppet@production] Keystone: remove openstack::keystone::cleanup

https://gerrit.wikimedia.org/r/589876