Update keystone default softparams
Moves _param:keystone_tokens_expiration: 3600 definition
into defaults/openstack/init.yml
Add default soft params for the keystone fernet rotation:
keystone_fernet_rotate_rsync_minute = 0
keystone_fernet_rotate_rsync_hour = '*'
Add default soft param for the keystone [token] allow_expired_window:
keystone_tokens_allow_expired_window = ''
Adjuststed the max_active_keys default value according to the following defaults:
``[token] allow_expired_window`` = 172800 (48 hours)
``[token] expiration`` = 3600 (1 hour)
rotation_frequency = 1 hour (keystone_fernet_rotate_rsync_minute/hour = 0 *)
max_active_keys = (allow_expired_window + expiration)/rotation_frequency + 2
keystone_tokens_max_active_keys = 51
Change-Id: I7a2a252afb34de9f3c7c4a1549f67d534959ecf9
Related-Prod: PROD-27591
diff --git a/keystone/server/single.yml b/keystone/server/single.yml
index 6996968..9663488 100644
--- a/keystone/server/single.yml
+++ b/keystone/server/single.yml
@@ -13,7 +13,6 @@
mysql_admin_user: root
mysql_admin_password: password
mysql_keystone_password: password
- keystone_tokens_expiration: 3600
openstack_node_role: primary
keystone_service_protocol: ${_param:cluster_internal_protocol}
linux:
@@ -57,7 +56,8 @@
tokens:
engine: fernet
expiration: ${_param:keystone_tokens_expiration}
- max_active_keys: 3
+ max_active_keys: ${_param:keystone_tokens_max_active_keys}
+ allow_expired_window: ${_param:keystone_tokens_allow_expired_window}
location: /var/lib/keystone/fernet-keys
credential:
location: /var/lib/keystone/credential-keys