Keystone Fernet keys rotation

Registered by Emilien Macchi on 2017-03-14

This blueprint will help to make Keystone Fernet keys rotations working in TripleO multinode environment, in a way that scale, is secure and is friendly for operators.

Blueprint information

Status:
Complete
Approver:
Emilien Macchi
Priority:
High
Drafter:
Emilien Macchi
Direction:
Approved
Assignee:
Juan Antonio Osorio Robles
Definition:
Approved
Series goal:
Accepted for pike
Implementation:
Implemented
Milestone target:
milestone icon pike-3
Started by
Emilien Macchi on 2017-03-22
Completed by
Emilien Macchi on 2017-07-31

Related branches

Sprints

Whiteboard

Add fernet as default provider:
Add support for fernet in containerized keystone:
Address key rotation:

Gerrit topic: https://review.openstack.org/#q,topic:bp/keystone-fernet-rotation,n,z

Undercloud work:
Addressed by: https://review.openstack.org/448344
    Configure Keystone Fernet Keys rotations in a secure way

Overcloud work:
WIP, currently being designed on https://review.openstack.org/445592

https://review.openstack.org/#/q/topic:fernet-keys-rotate

Gerrit topic: https://review.openstack.org/#q,topic:fernet-keys-rotate,n,z

Addressed by: https://review.openstack.org/473388
    Create mistral action to rotate fernet keys from passwords variable

Addressed by: https://review.openstack.org/473387
    Add KeystoneFernetKeys to generated passwords

Addressed by: https://review.openstack.org/473389
    Use KeystoneFernetKeys instead of individual parameters

Addressed by: https://review.openstack.org/473390
    Enable heat/puppet to manage the fernet keys and make it configurable

Addressed by: https://review.openstack.org/474532
    Make fernet max active keys configurable

Addressed by: https://review.openstack.org/474573
    Add fernet keys purging based no t-h-t parameter

Addressed by: https://review.openstack.org/474574
    Enable key rotation action and add release note

Addressed by: https://review.openstack.org/475732
    Add workbook to rotate fernet keys

Gerrit topic: https://review.openstack.org/#q,topic:key-rotation,n,z

Addressed by: https://review.openstack.org/477607
    Create ansible config file and disable retry files

(emilien) We are missing documentation on how to enable this feature. Juan, can we work on it before end of Pike?

Addressed by: https://review.openstack.org/487428
    Add documentation for fernet key rotation

(?)

Work Items

This blueprint contains Public information 
Everyone can see this information.