Update keystone default softparams
Moves _param:keystone_tokens_expiration: 3600 definition
into defaults/openstack/init.yml
Add default soft params for the keystone fernet rotation:
keystone_fernet_rotate_rsync_minute = 0
keystone_fernet_rotate_rsync_hour = '*'
Add default soft param for the keystone [token] allow_expired_window:
keystone_tokens_allow_expired_window = ''
Adjuststed the max_active_keys default value according to the following defaults:
``[token] allow_expired_window`` = 172800 (48 hours)
``[token] expiration`` = 3600 (1 hour)
rotation_frequency = 1 hour (keystone_fernet_rotate_rsync_minute/hour = 0 *)
max_active_keys = (allow_expired_window + expiration)/rotation_frequency + 2
keystone_tokens_max_active_keys = 51
Change-Id: I7a2a252afb34de9f3c7c4a1549f67d534959ecf9
Related-Prod: PROD-27591
(cherry picked from commit 1558a8ee927fa4f952fa4fd5c4c0e4adbaa6d03e)
Set default keystone_tokens_allow_expired_window
Set keystone_tokens_allow_expired_window = 172800
Change-Id: I65595c09ed31c302d4cdec52e73bc52abc58d80d
Related-Prod: PROD-27591
(cherry picked from commit 8b98a638d7243f4eab10da8ca6a5e728a60c2deb)
diff --git a/defaults/openstack/init.yml b/defaults/openstack/init.yml
index 6623b29..b75f0c8 100644
--- a/defaults/openstack/init.yml
+++ b/defaults/openstack/init.yml
@@ -87,6 +87,24 @@
keystone_old_version: ${_param:openstack_old_version}
keystone_version: ${_param:openstack_version}
keystone_upgrade_enabled: ${_param:openstack_upgrade_enabled}
+ # (obryndzii) Rotating keys too frequently, or with ``[fernet_tokens] max_active_keys``
+ # set too low, will cause tokens to become invalid prior to their expiration.
+ # As tokens may be fetched beyond their initial expiration period (nova live migration,
+ # cider volume backup), keys should not be fully rotated within the period of
+ # ``[token] expiration``+``[token] allow_expired_window`` seconds to prevent the tokens
+ # becoming unavailable.
+ # The max_active_keys default value was adjusted according to the following defaults:
+ # [token]/allow_expired_window = 172800 (48 hours)
+ # [token]/expiration = 3600 (1 hour)
+ # rotation_frequency = 1 hour (keystone_fernet_rotate_rsync_minute/hour 0 *)
+ # max_active_keys = (allow_expired_window + expiration)/rotation_frequency + 2
+ # In case of changing those defaults the keystone_tokens_max_active_keys value should be
+ # calculated according to the definition above.
+ keystone_tokens_expiration: 3600
+ keystone_tokens_max_active_keys: 51
+ keystone_tokens_allow_expired_window: 172800
+ keystone_fernet_rotate_rsync_minute: 0
+ keystone_fernet_rotate_rsync_hour: '*'
# Manila
manila_old_version: ${_param:openstack_old_version}
manila_version: ${_param:openstack_version}