openstack/puppet-openstack-integration
Code Issues Proposed changes

Reduce fernet_rotate frequency

Browse Source 
Currently it's every 10 minutes. When using expiration time of 40
minutes (scenario001) or longer, this is too frequent and in some cases,
jobs are failing with InvalidToken in scenario001. To avoid this we can
run fernet_rotate less often or increase max_active_keys [1]. In this
case i'm making it to rotate every 30 minutes instead of 10.

[1] https://docs.openstack.org/keystone/latest/admin/fernet-token-faq.html#i-rotated-keys-and-now-tokens-are-invalidating-early-what-did-i-do

Change-Id: Ia19612b668313752b62545ce5cae49396671b939
This commit is contained in:
Alfredo Moralejo 2019-11-15 15:44:18 +01:00
parent ad4a9f17c0
commit fc3f3e14f5
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
manifests/keystone.pp
View File

@ -50,7 +50,7 @@ class openstack_integration::keystone (
class { '::keystone::cron::token_flush': } class { '::keystone::cron::token_flush': }
class { '::keystone::cron::fernet_rotate': class { '::keystone::cron::fernet_rotate':
hour => '*', hour => '*',
minute => '*/10', minute => '*/30',
} }
class { '::keystone::db::mysql': class { '::keystone::db::mysql':
password => 'keystone', password => 'keystone',