Merge "Fix keystone fernet file exchange via ssh"

10 files changed, 25 insertions, 25 deletions

diff --git a/ansible/roles/keystone/tasks/config.yml b/ansible/roles/keystone/tasks/config.yml
index d7840fff6..e39e7d618 100644
--- a/ansible/roles/keystone/tasks/config.yml
+++ b/ansible/roles/keystone/tasks/config.yml
@@ -101,6 +101,8 @@
     - { src: "crontab.j2", dest: "crontab" }
     - { src: "fernet-rotate.sh.j2", dest: "fernet-rotate.sh" }
     - { src: "fernet-node-sync.sh.j2", dest: "fernet-node-sync.sh" }
+    - { src: "id_rsa", dest: "id_rsa" }
+    - { src: "ssh_config.j2", dest: "ssh_config" }
   when: keystone_token_provider == 'fernet'
 
 - name: Copying files for keystone-ssh
@@ -109,7 +111,5 @@
     dest: "{{ node_config_directory }}/keystone-ssh/{{ item.dest }}"
   with_items:
     - { src: "sshd_config.j2", dest: "sshd_config" }
-    - { src: "id_rsa", dest: "id_rsa" }
     - { src: "id_rsa.pub", dest: "id_rsa.pub" }
-    - { src: "ssh_config.j2", dest: "ssh_config" }
   when: keystone_token_provider == 'fernet'
diff --git a/ansible/roles/keystone/templates/crontab.j2 b/ansible/roles/keystone/templates/crontab.j2
index 967309793..af16e114f 100644
--- a/ansible/roles/keystone/templates/crontab.j2
+++ b/ansible/roles/keystone/templates/crontab.j2
@@ -1,3 +1,3 @@
 {% for cron_job in cron_jobs %}
 {{ cron_job['min'] }} {{ cron_job['hour'] }} * * {{ cron_job['day'] }} /usr/bin/fernet-rotate.sh
-{% endfor %}
\ No newline at end of file
+{% endfor %}
diff --git a/ansible/roles/keystone/templates/fernet-node-sync.sh.j2 b/ansible/roles/keystone/templates/fernet-node-sync.sh.j2
index ffbd7c7dd..a100f2377 100644
--- a/ansible/roles/keystone/templates/fernet-node-sync.sh.j2
+++ b/ansible/roles/keystone/templates/fernet-node-sync.sh.j2
@@ -11,6 +11,6 @@ fi
 # For each host node sync tokens
 {% for host in groups['keystone'] %}
 {% if inventory_hostname != host %}
-/usr/bin/rsync -azu --delete -e 'ssh -i /var/lib/keystone/.ssh/id_rsa -p {{ keystone_ssh_port }}' keystone@{{ host }}:/etc/keystone/fernet-keys/ /etc/keystone/fernet-keys
+/usr/bin/rsync -azu --delete -e 'ssh -i /var/lib/keystone/.ssh/id_rsa -p {{ keystone_ssh_port }} -F /var/lib/keystone/.ssh/config' keystone@{{ host }}:/etc/keystone/fernet-keys/ /etc/keystone/fernet-keys
 {% endif %}
-{% endfor %}
\ No newline at end of file
+{% endfor %}
diff --git a/ansible/roles/keystone/templates/fernet-rotate.sh.j2 b/ansible/roles/keystone/templates/fernet-rotate.sh.j2
index e79b8909d..28c5b6f67 100644
--- a/ansible/roles/keystone/templates/fernet-rotate.sh.j2
+++ b/ansible/roles/keystone/templates/fernet-rotate.sh.j2
@@ -4,6 +4,6 @@ keystone-manage --config-file /etc/keystone/keystone.conf fernet_rotate --keysto
 
 {% for host in groups['keystone'] %}
 {% if inventory_hostname != host %}
-/usr/bin/rsync -az -e 'ssh -i /var/lib/keystone/.ssh/id_rsa -p {{ keystone_ssh_port }}' --delete /etc/keystone/fernet-keys/ keystone@{{ host }}:/etc/keystone/fernet-keys
+/usr/bin/rsync -az -e 'ssh -i /var/lib/keystone/.ssh/id_rsa -p {{ keystone_ssh_port }} -F /var/lib/keystone/.ssh/config' --delete /etc/keystone/fernet-keys/ keystone@{{ host }}:/etc/keystone/fernet-keys
 {% endif %}
-{% endfor %}
\ No newline at end of file
+{% endfor %}
diff --git a/ansible/roles/keystone/templates/id_rsa b/ansible/roles/keystone/templates/id_rsa
index bdce5093e..3e2716616 100644
--- a/ansible/roles/keystone/templates/id_rsa
+++ b/ansible/roles/keystone/templates/id_rsa
@@ -1 +1 @@
-{{ keystone_ssh_key.private_key }}
\ No newline at end of file
+{{ keystone_ssh_key.private_key }}
diff --git a/ansible/roles/keystone/templates/id_rsa.pub b/ansible/roles/keystone/templates/id_rsa.pub
index 907b0e7e7..529f98ab8 100644
--- a/ansible/roles/keystone/templates/id_rsa.pub
+++ b/ansible/roles/keystone/templates/id_rsa.pub
@@ -1 +1 @@
-{{ keystone_ssh_key.public_key }}
\ No newline at end of file
+{{ keystone_ssh_key.public_key }}
diff --git a/ansible/roles/keystone/templates/keystone-fernet.json.j2 b/ansible/roles/keystone/templates/keystone-fernet.json.j2
index b74f01715..9078977b5 100644
--- a/ansible/roles/keystone/templates/keystone-fernet.json.j2
+++ b/ansible/roles/keystone/templates/keystone-fernet.json.j2
@@ -24,6 +24,18 @@
             "dest": "/usr/bin/fernet-node-sync.sh",
             "owner": "root",
             "perm": "0755"
+        },
+        {
+            "source": "{{ container_config_directory }}/ssh_config",
+            "dest": "/var/lib/keystone/.ssh/config",
+            "owner": "keystone",
+            "perm": "0600"
+        },
+        {
+            "source": "{{ container_config_directory }}/id_rsa",
+            "dest": "/var/lib/keystone/.ssh/id_rsa",
+            "owner": "keystone",
+            "perm": "0600"
         }
     ]
 }
diff --git a/ansible/roles/keystone/templates/keystone-ssh.json.j2 b/ansible/roles/keystone/templates/keystone-ssh.json.j2
index c38fd6d62..c13e0eda6 100644
--- a/ansible/roles/keystone/templates/keystone-ssh.json.j2
+++ b/ansible/roles/keystone/templates/keystone-ssh.json.j2
@@ -8,22 +8,10 @@
             "perm": "0644"
         },
         {
-            "source": "{{ container_config_directory }}/ssh_config",
-            "dest": "/var/lib/keystone/.ssh/config",
-            "owner": "keystone",
-            "perm": "0600"
-        },
-        {
-            "source": "{{ container_config_directory }}/id_rsa",
-            "dest": "/var/lib/keystone/.ssh/id_rsa",
-            "owner": "keystone",
-            "perm": "0600"
-        },
-        {
             "source": "{{ container_config_directory }}/id_rsa.pub",
             "dest": "/var/lib/keystone/.ssh/authorized_keys",
             "owner": "keystone",
             "perm": "0600"
         }
     ]
-}
\ No newline at end of file
+}
diff --git a/ansible/roles/keystone/templates/ssh_config.j2 b/ansible/roles/keystone/templates/ssh_config.j2
index f30dee26d..4a177f655 100644
--- a/ansible/roles/keystone/templates/ssh_config.j2
+++ b/ansible/roles/keystone/templates/ssh_config.j2
@@ -1,4 +1,4 @@
-Host {% for host in groups['keystone'] %}{% if inventory_hostname != host %}{{ host }} {% endif %}{% endfor %}
+Host *
   StrictHostKeyChecking no
   UserKnownHostsFile /dev/null
-  Port {{ keystone_ssh_port }}
\ No newline at end of file
+  Port {{ keystone_ssh_port }}
diff --git a/ansible/roles/keystone/templates/sshd_config.j2 b/ansible/roles/keystone/templates/sshd_config.j2
index 8ccb34062..8b66f42c7 100644
--- a/ansible/roles/keystone/templates/sshd_config.j2
+++ b/ansible/roles/keystone/templates/sshd_config.j2
@@ -2,4 +2,4 @@ Port {{ keystone_ssh_port }}
 ListenAddress {{ hostvars[inventory_hostname]['ansible_' + api_interface]['ipv4']['address'] }}
 
 SyslogFacility AUTHPRIV
-UsePAM yes
\ No newline at end of file
+UsePAM yes