Add fernet key rotation - #478
Conversation
|
Skipping CI for Draft Pull Request. |
|
/test all |
|
I'm keeping it as draft, since there is a mismatch of the names of mounted keys [1]. This will likely change, since |
|
/test all |
|
/test all |
54fc55a to
de882bc
Compare
|
This pull request now also contains all changes needed in the keystone-operator to support variable number of keys |
9444571 to
871490d
Compare
|
If we land this PR please add the associated RELATED_IMAGE into the openstack-operator here: https://github.com/openstack-k8s-operators/openstack-operator/blob/main/config/default/manager_default_images.yaml |
| } | ||
| rotatedAt, err := time.Parse(time.RFC3339, secret.Annotations[fernetAnnotation]) | ||
|
|
||
| var duration int |
There was a problem hiding this comment.
nit: would move this (L1392-L1397) up so that err is checked right after setting
Add configuration for specifying the number of fernet keys stored in the keystone secret. More than 2 keys are needed, since rotating 2 keys would expire sessions on every rotation. After configuration change, keys need to be added/removed and rotated in the proper order, to ensure that the sessions don't expire prematurely. Fernet key rotation is triggered in the reconcile loop. The "rotated at" timestamp is set in the secret annotation. Co-Authored-By: Grzegorz Grasza <xek@redhat.com>
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: olliewalsh, xek The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
6 participants
As part of this work, we needed to implement more than 2 keys, since rotating 2 would expire sessions on every rotation. There are new settings and the defaults are the same as in "old-gen" Tripelo.
jira: OSPRH-9309