524868c632
This adds the docker aspects of fernet key bootstrapping as well as distributed key rotation. - Bootstrapping is handled in the same way as keystone bootstrap. - A new keystone-fernet and keystone-ssh container is created to allow the nodes to communicate with each other (taken from nova-ssh). - The keystone-fernet is a keystone container with crontab installed. This will handle key rotations through keystone-manage and trigger an rsync to push new tokens to other nodes. The Ansible component is implemented in: https://review.openstack.org/#/c/349366 Change-Id: Id610e00e8c63c7f1bc0974c0aa1b3f44c18e1019 Partially-Implements: blueprint keystone-fernet-token Partially-Implements: blueprint third-party-plugin-support
26 lines
899 B
Django/Jinja
26 lines
899 B
Django/Jinja
FROM {{ namespace }}/{{ image_prefix }}keystone-base:{{ tag }}
|
|
MAINTAINER {{ maintainer }}
|
|
{% import "macros.j2" as macros with context %}
|
|
|
|
{% if base_distro in ['fedora', 'centos', 'oraclelinux', 'rhel'] %}
|
|
{% set keystone_fernet_packages = [
|
|
'cronie',
|
|
'rsync'
|
|
] %}
|
|
{% elif base_distro in ['ubuntu', 'debian'] %}
|
|
{% set keystone_fernet_packages = [
|
|
'cron',
|
|
'rsync'
|
|
] %}
|
|
{% endif %}
|
|
{{ macros.install_packages(keystone_fernet_packages | customizable("packages")) }}
|
|
|
|
COPY fetch_fernet_tokens.py /usr/bin/
|
|
COPY keystone_bootstrap.sh /usr/local/bin/kolla_keystone_bootstrap
|
|
COPY extend_start.sh /usr/local/bin/kolla_extend_start
|
|
RUN chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_keystone_bootstrap /usr/bin/fetch_fernet_tokens.py
|
|
|
|
{% block keystone_fernet_footer %}{% endblock %}
|
|
{% block footer %}{% endblock %}
|
|
{{ include_footer }}
|