Add fernet key rotation #478
Conversation
|
Skipping CI for Draft Pull Request. |
|
/test all |
|
I'm keeping it as draft, since there is a mismatch of the names of mounted keys [1]. This will likely change, since |
|
/test all |
|
/test all |
xek
force-pushed
the
fernet-rotation
branch
2 times, most recently
from
54fc55a
to
de882bc
Compare
|
This pull request now also contains all changes needed in the keystone-operator to support variable number of keys |
xek
force-pushed
the
fernet-rotation
branch
2 times, most recently
from
9444571
to
871490d
Compare
|
If we land this PR please add the associated RELATED_IMAGE into the openstack-operator here: https://github.com/openstack-k8s-operators/openstack-operator/blob/main/config/default/manager_default_images.yaml |
| } | ||
| rotatedAt, err := time.Parse(time.RFC3339, secret.Annotations[fernetAnnotation]) | ||
|
|
||
| var duration int |
There was a problem hiding this comment.
nit: would move this (L1392-L1397) up so that err is checked right after setting
Add configuration for specifying the number of fernet keys stored in the keystone secret. More than 2 keys are needed, since rotating 2 keys would expire sessions on every rotation. After configuration change, keys need to be added/removed and rotated in the proper order, to ensure that the sessions don't expire prematurely. Fernet key rotation is triggered in the reconcile loop. The "rotated at" timestamp is set in the secret annotation. Co-Authored-By: Grzegorz Grasza <[email protected]>
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: olliewalsh, xek The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-merge-bot
bot
merged commit 61e711f
into
openstack-k8s-operators:main
As part of this work, we needed to implement more than 2 keys, since rotating 2 would expire sessions on every rotation. There are new settings and the defaults are the same as in "old-gen" Tripelo.
jira: OSPRH-9309