Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

warn about max_active_keys fernet keys #165

Open
AlvaroVega opened this issue Sep 29, 2020 · 3 comments
Open

warn about max_active_keys fernet keys #165

AlvaroVega opened this issue Sep 29, 2020 · 3 comments

Comments

@AlvaroVega
Copy link
Member

From @cesarjorgemartinez

Receipt and Token fernet key directories are the same but `max_active_keys` is different. Receipt `max_active_keys` will be ignored in favor of Token `max_active_keys`
@AlvaroVega AlvaroVega transferred this issue from telefonicaid/orchestrator Nov 10, 2020
@cesarjorgemartinez
Copy link
Contributor

You need to set equal (6 is better value), for:

[fernet_receipts]
max_active_keys = 6

And

[fernet_tokens]
max_active_keys = 6

@AlvaroVega
Copy link
Member Author

AlvaroVega commented Dec 15, 2021

Then the fix will be add these commands to startup scripts:

openstack-config --set /etc/keystone/keystone.conf \
                 fernet_receipts max_active_keys 6 

openstack-config --set /etc/keystone/keystone.conf \
                 fernet_tokens max_active_keys 6 

@cesarjorgemartinez
Copy link
Contributor

Yes, and I think it is not worth customizing it as a parameter, what do you think?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants