openstack/kolla-ansible.git/ansible/roles/keystone/templates/keystone-ssh.json.j2, branch stable/2026.1

Fix for overly restrictive permissions on ca-certificates directory

2026-05-12T05:56:37+00:00

Closes-Bug: #2112280 Change-Id: I52499bdf2b7fc70f91a4c2920749bfef83a79850 Signed-off-by: Rafal Lewandowski Signed-off-by: Michal Nasiadka (cherry picked from commit e302bab31f30296f7d6f41c3d46e19cf5668b97a)

Add TLS support for MariaDB Connections

2025-07-09T11:41:04+00:00

Since Kolla-Ansible now supports TLS for MariaDB, this patch adds support for services that can use this feature. This feature can be used only when ProxySQL is used as LB. Signed-off-by: Michal Arbet Change-Id: I052c763073c5da29cb8e78004a01a22217dde5da

Don't notify handlers during copy-cert

2024-12-01T21:16:25+00:00

This is a prerequisite for patchset #745164 This fixes unwanted restarts during copying of certificates. By removing conditional statements from role handlers in #745164, copying certificates caused containers to restart, this is unwanted during the genconfig process. However, if we would remove handler notifiers from copying certificates, the container would never restart, since from #745164, containers will restart only if any of the files specified in config.json change. Certificates are now copied to intermediary location inside of the container, from which the script kolla_copy_cacerts will install them in the trust store. Depends-on: https://review.opendev.org/c/openstack/kolla/+/926882 Change-Id: Ib89048c7e0f250182c4bf57d8c8a1b5478e9b4ab Signed-off-by: Roman Krček

Fix permission denied during Fernet key rotation

2020-10-22T08:33:11+00:00

During a deploy, if keystone Fernet key rotation happens before the keystone container starts, the rotation may fail with 'permission denied'. This happens because config.json for Keystone sets the permissions for /etc/keystone/fernet-keys. This change fixes the issue by also setting the permissions for /etc/keystone/fernet-keys in config.json for keystone-fernet and keystone-ssh. Change-Id: I561e4171d14dcaad8a2a9a36ccab84a670daa904 Closes-Bug: #1888512

Change default permissions in jinja templates.

2017-05-26T11:29:02+00:00

Many of the templates use 600, remove unnecessary permission on these templates to bring them in line with the others. Change-Id: I30fe1b3822b9c7bb6ab98729fc519dc1d603db27

Fix keystone fernet file exchange via ssh

2016-10-12T16:29:34+00:00

* install openssh client in keystone-fernet container * install rsync in keystone-ssh container * fix syntax issue in ssh configuration * copy ssh configuration into keystone-fernet container * copy id_rsa.pub into keystone-ssh container * copy id_rsa into keystone-fernet container * use full path to ssh binary in used scripts * add missing newlines at EOF * when using type source set /var/lib/keystone as home directory for the user keystone Co-Authored-By: Jeffrey Zhang Change-Id: Id6b41030056a69f6516a054beb2fc0e08226e876 Closes-bug: #1623013

Add full support for fernet

2016-08-25T10:08:22+00:00

This addresses the ansible aspects of fernet key bootstrapping as well as distributed key rotation. - Bootstrapping is handled in the same way as keystone bootstrap. - A new keystone-fernet and keystone-ssh container is created to allow the nodes to communicate with each other (taken from nova-ssh). - The keystone-fernet is a keystone container with crontab installed. This will handle key rotations through keystone-manage and trigger an rsync to push new tokens to other nodes. - Key rotation is setup to be balanced across the keystone nodes using a round-robbin style. This ensures that any node failures will not stop the keys from rotating. This is configured by a desired token expiration time which then determines the cron scheduling for each node as well as the number of fernet tokens in rotation. - Ability for recovered node to resync with the cluster. When a node starts it will run sanity checks to ensure that its fernet tokens are not stale. If they are it will rsync with other nodes to ensure its tokens are up to date. The Docker component is implemented in: https://review.openstack.org/#/c/349366 Change-Id: I15052c25a1d1149d364236f10ced2e2346119738 Implements: blueprint keystone-fernet-token