From eb923b0fae8eef49b8b2abf19e3035c20c4138dc Mon Sep 17 00:00:00 2001 From: Juan Antonio Osorio Robles Date: Thu, 11 May 2017 10:45:45 +0300 Subject: Disabling replacing fernet keys from puppet Once puppet has written the initial fernet keys, if a deployer wants to rotate them, the keys will be overwritten when another overcloud deploy is executed (for instance, for updates or upgrades). This disables replacing this keys via puppet, so now the operator can rotate the keys out of band. Change-Id: I01fd46ba7c5e0db12524095dc9fe29e90cb0de57 --- puppet/services/keystone.yaml | 1 + 1 file changed, 1 insertion(+) (limited to 'puppet/services') diff --git a/puppet/services/keystone.yaml b/puppet/services/keystone.yaml index 58b2b7bf..c42b0530 100644 --- a/puppet/services/keystone.yaml +++ b/puppet/services/keystone.yaml @@ -231,6 +231,7 @@ outputs: content: {get_param: KeystoneFernetKey0} '/etc/keystone/fernet-keys/1': content: {get_param: KeystoneFernetKey1} + keystone::fernet_replace_keys: false keystone::debug: {get_param: Debug} keystone::rabbit_userid: {get_param: RabbitUserName} keystone::rabbit_password: {get_param: RabbitPassword} -- cgit 1.2.3-korg