Trigger fernet rotation inside keystone-operator

Author: xek

api/bases/keystone.openstack.org_keystoneapis.yaml

@@ -99,6 +99,12 @@ spec:
                 description: Keystone Fernet Rotation Container Image URL (will be
                   set to environmental default if empty)
                 type: string
+              fernetRotationDays:
+                default: 1
+                description: FernetRotationDays - Rotate fernet token keys every X
+                  days
+                format: int32
+                type: integer
               fernetRotationSchedule:
                 default: 1 0 * * *
                 description: FernetRotationSchedule - Schedule rotate fernet token

api/v1beta1/keystoneapi_types.go

@@ -125,6 +125,11 @@ type KeystoneAPISpecCore struct {
 	// TrustFlushSuspend - Suspend the cron job to purge trusts
 	TrustFlushSuspend bool `json:"trustFlushSuspend"`
 
+	// +kubebuilder:validation:Optional
+	// +kubebuilder:default=1
+	// FernetRotationDays - Rotate fernet token keys every X days
+	FernetRotationDays *int32 `json:"fernetRotationDays"`
+
 	// +kubebuilder:validation:Optional
 	// +kubebuilder:default="1 0 * * *"
 	// FernetRotationSchedule - Schedule rotate fernet token keys

api/v1beta1/zz_generated.deepcopy.go

@@ -99,6 +99,12 @@ spec:
                 description: Keystone Fernet Rotation Container Image URL (will be
                   set to environmental default if empty)
                 type: string
+              fernetRotationDays:
+                default: 1
+                description: FernetRotationDays - Rotate fernet token keys every X
+                  days
+                format: int32
+                type: integer
               fernetRotationSchedule:
                 default: 1 0 * * *
                 description: FernetRotationSchedule - Schedule rotate fernet token

config/crd/bases/keystone.openstack.org_keystoneapis.yaml

@@ -880,7 +880,6 @@ func (r *KeystoneAPIReconciler) reconcileNormal(
 	//
 	// Create secret holding fernet keys (for token and credential)
 	//
-	// TODO key rotation
 	err = r.ensureFernetKeys(ctx, instance, helper, &configMapVars)
 	if err != nil {
 		instance.Status.Conditions.Set(condition.FalseCondition(
@@ -1365,14 +1364,16 @@ func (r *KeystoneAPIReconciler) reconcileCloudConfig(
 	return oko_secret.EnsureSecrets(ctx, h, instance, secrets, nil)
 }
 
-// ensureFernetKeys - creates secret with fernet keys
+// ensureFernetKeys - creates secret with fernet keys, rotates the keys
 func (r *KeystoneAPIReconciler) ensureFernetKeys(
 	ctx context.Context,
 	instance *keystonev1.KeystoneAPI,
 	helper *helper.Helper,
 	envVars *map[string]env.Setter,
 ) error {
+	fernetLabel := labels.GetGroupLabel(keystone.ServiceName) + "/rotatedat"
 	labels := labels.GetLabels(instance, labels.GetGroupLabel(keystone.ServiceName), map[string]string{})
+	now := time.Now().UTC()
 
 	//
 	// check if secret already exist
@@ -1394,6 +1395,8 @@ func (r *KeystoneAPIReconciler) ensureFernetKeys(
 			fernetKeys[fmt.Sprintf("FernetKeys%d", i)] = keystone.GenerateFernetKey()
 		}
 
+		labels[fernetLabel] = now.Format(time.RFC3339)
+
 		tmpl := []util.Template{
 			{
 				Name:       secretName,
@@ -1414,11 +1417,16 @@ func (r *KeystoneAPIReconciler) ensureFernetKeys(
 		changedKeys := false
 
 		extraKey := fmt.Sprintf("FernetKeys%d", numberKeys)
+
 		//
 		// Fernet Key rotation
 		//
+		rotatedAt, err := time.Parse(time.RFC3339, labels[fernetLabel])
+		duration := int(*instance.Spec.FernetRotationDays)
 
-		if false { // TODO: trigger rotation
+		if err != nil {
+			labels[fernetLabel] = now.Format(time.RFC3339)
+		} else if rotatedAt.AddDate(0, 0, duration).After(now) {
 			secret.Data[extraKey] = secret.Data["FernetKeys0"]
 			secret.Data["FernetKeys0"] = []byte(keystone.GenerateFernetKey())
 		}