From fe4f6adaf01e93af39cd28d3ad57d45b1db11884 Mon Sep 17 00:00:00 2001 From: Owen Jones Date: Mon, 10 Aug 2026 11:44:47 +0100 Subject: fix: Delegate fernet key distribution to correct host The key used to group hosts was previously changed[0] but the group not updated in the task used to distribute fernet keys. When migrating hosts this could lead to the task being delegated to a host without keys, resulting in all hosts losing their keys. 0: Change I1db88e28a828ebf073f018b2bae1d9556ec22807 Closes-Bug: #2163158 Change-Id: Ia76f3e6cb41a30b88ac885832755ebe5264ad9fc Signed-off-by: Owen Jones (cherry picked from commit 541a26c7d4dd1988eda64327c6b08aa831ee3162) --- ansible/roles/keystone/tasks/distribute_fernet.yml | 6 ++---- releasenotes/notes/fix-fernet-distribution-96a52af5a5641871.yaml | 6 ++++++ 2 files changed, 8 insertions(+), 4 deletions(-) create mode 100644 releasenotes/notes/fix-fernet-distribution-96a52af5a5641871.yaml diff --git a/ansible/roles/keystone/tasks/distribute_fernet.yml b/ansible/roles/keystone/tasks/distribute_fernet.yml index a780cf8da..2bb346da9 100644 --- a/ansible/roles/keystone/tasks/distribute_fernet.yml +++ b/ansible/roles/keystone/tasks/distribute_fernet.yml @@ -9,11 +9,9 @@ retries: 10 delay: 5 -- name: Run key distribution +- name: Run fernet key distribution become: true changed_when: true ansible.builtin.command: "{{ kolla_container_engine }} exec -t {{ keystone_services['keystone-fernet']['container_name'] }} /usr/bin/fernet-push.sh" run_once: true - delegate_to: >- - {% if groups['keystone_fernet_running'] is defined -%} - {{ groups['keystone_fernet_running'][0] }}{%- else -%}{{ groups['keystone'][0] }}{%- endif %} + delegate_to: "{{ (groups['keystone_fernet_running_True'] | default(groups['keystone']))[0] }}" diff --git a/releasenotes/notes/fix-fernet-distribution-96a52af5a5641871.yaml b/releasenotes/notes/fix-fernet-distribution-96a52af5a5641871.yaml new file mode 100644 index 000000000..c7cf4d7a4 --- /dev/null +++ b/releasenotes/notes/fix-fernet-distribution-96a52af5a5641871.yaml @@ -0,0 +1,6 @@ +--- +fixes: + - | + Fernet key distribution is now delegated to a host in the correct + group when run on existing deployments. + `LP#2163158 `__ -- cgit v1.2.3