<html>
<head>
<meta name="generator" content="Windows Mail 17.5.9600.20911">
<style data-externalstyle="true"><!--
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph {
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
}
p.MsoNormal, li.MsoNormal, div.MsoNormal {
margin:0in;
margin-bottom:.0001pt;
}
p.MsoListParagraphCxSpFirst, li.MsoListParagraphCxSpFirst, div.MsoListParagraphCxSpFirst,
p.MsoListParagraphCxSpMiddle, li.MsoListParagraphCxSpMiddle, div.MsoListParagraphCxSpMiddle,
p.MsoListParagraphCxSpLast, li.MsoListParagraphCxSpLast, div.MsoListParagraphCxSpLast {
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
line-height:115%;
}
--></style></head>
<body dir="ltr">
<div data-externalstyle="false" dir="ltr" style="font-family: 'Calibri', 'Segoe UI', 'Meiryo', 'Microsoft YaHei UI', 'Microsoft JhengHei UI', 'Malgun Gothic', 'sans-serif';font-size:12pt;">
<div><pre style='font: 12px/16.36px "andale mono", "lucida console", monospace; margin: 1.5em 0px; padding: 0px; border: 0px black; border-image: none; color: rgb(83, 83, 83); text-transform: none; text-indent: 0px; letter-spacing: normal; word-spacing: 0px; vertical-align: baseline; white-space: pre-wrap; widows: 1; font-size-adjust: none; font-stretch: normal; background-color: rgb(255, 255, 255);'>I suggest to use pacemaker multistate clone resource to rotate and rsync fernet tokens from local directories across cluster nodes. The resource prototype is described here <a href="https://etherpad.openstack.org/p/fernet_tokens_pacemaker" target="_parent">https://etherpad.openstack.org/p/fernet_tokens_pacemaker</a></pre><pre style='font: 12px/16.36px "andale mono", "lucida console", monospace; margin: 1.5em 0px; padding: 0px; border: 0px black; border-image: none; color: rgb(83, 83, 83); text-transform: none; text-indent: 0px; letter-spacing: normal; word-spacing: 0px; vertical-align: baseline; white-space: pre-wrap; widows: 1; font-size-adjust: none; font-stretch: normal; background-color: rgb(255, 255, 255);'>Pros: Pacemaker will care about CAP/split-brain stuff for us, we just design rotate and rsync logic. Also no shared FS/DB involved but only Corosync CIB - to store few internal resource state related params, not tokens.</pre><pre style='font: 12px/16.36px "andale mono", "lucida console", monospace; margin: 1.5em 0px; padding: 0px; border: 0px black; border-image: none; color: rgb(83, 83, 83); text-transform: none; text-indent: 0px; letter-spacing: normal; word-spacing: 0px; vertical-align: baseline; white-space: pre-wrap; widows: 1; font-size-adjust: none; font-stretch: normal; background-color: rgb(255, 255, 255);'>Cons: Keystone nodes hosting fernet tokens directories must be members of pacemaker cluster. Also custom OCF script should be created to implement this.</pre><pre style='font: 12px/16.36px "andale mono", "lucida console", monospace; margin: 1.5em 0px; padding: 0px; border: 0px black; border-image: none; color: rgb(83, 83, 83); text-transform: none; text-indent: 0px; letter-spacing: normal; word-spacing: 0px; vertical-align: baseline; white-space: pre-wrap; widows: 1; font-size-adjust: none; font-stretch: normal; background-color: rgb(255, 255, 255);'><div>__</div><div>Regards,</div><div>Bogdan Dobrelya.</div><div>IRC: bogdando</div><div><br></div></pre><pre style='font: 12px/16.36px "andale mono", "lucida console", monospace; margin: 1.5em 0px; padding: 0px; border: 0px black; border-image: none; color: rgb(83, 83, 83); text-transform: none; text-indent: 0px; letter-spacing: normal; word-spacing: 0px; vertical-align: baseline; white-space: pre-wrap; widows: 1; font-size-adjust: none; font-stretch: normal; background-color: rgb(255, 255, 255);'>Matt Fischer also discusses key rotation here:
<a style="margin: 0px; padding: 0px; border: 0px black; border-image: none; color: rgb(188, 21, 24); font-family: inherit; font-size: 12px; font-style: inherit; font-weight: inherit; text-decoration: none; vertical-align: baseline;" href="http://www.mattfischer.com/blog/?p=648" target="_parent">http://www.mattfischer.com/blog/?p=648</a>
And here:
<a style="margin: 0px; padding: 0px; border: 0px black; border-image: none; color: rgb(188, 21, 24); font-family: inherit; font-size: 12px; font-style: inherit; font-weight: inherit; text-decoration: none; vertical-align: baseline;" href="http://www.mattfischer.com/blog/?p=665" target="_parent">http://www.mattfischer.com/blog/?p=665</a>
On Mon, Jul 27, 2015 at 2:30 PM, Dolph Mathews <<a style="margin: 0px; padding: 0px; border: 0px black; border-image: none; color: rgb(188, 21, 24); font-family: inherit; font-size: 12px; font-style: inherit; font-weight: inherit; text-decoration: none; vertical-align: baseline;" href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_parent">dolph.mathews at gmail.com</a>>
wrote:
…
</pre><br></div>
</div>
</body>
</html>