<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>Our keystone database is clustered across regions, so we have this job running on node1 in each site on alternating hours. I don’t think you’d want a bunch of cron jobs firing off all at once to cleanup tokens on multiple clustered nodes. That’s one reason
I know not to put this in the code.</div>
<div><br>
</div>
<div>Are there other reasons that an operator might like to keep old tokens? Auditing?</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Tim Bell <<a href="mailto:Tim.Bell@cern.ch">Tim.Bell@cern.ch</a>><br>
<span style="font-weight:bold">Date: </span>Sunday, January 25, 2015 at 11:10 PM<br>
<span style="font-weight:bold">To: </span>Mike Smith <<a href="mailto:mismith@overstock.com">mismith@overstock.com</a>>, Daniel Comnea <<a href="mailto:comnea.dani@gmail.com">comnea.dani@gmail.com</a>><br>
<span style="font-weight:bold">Cc: </span>"OpenStack Development Mailing List (not for usage questions)" <<a href="mailto:openstack-dev@lists.openstack.org">openstack-dev@lists.openstack.org</a>>, "<a href="mailto:openstack-operators@lists.openstack.org">openstack-operators@lists.openstack.org</a>"
<<a href="mailto:openstack-operators@lists.openstack.org">openstack-operators@lists.openstack.org</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [Openstack-operators] [openstack-dev][openstack-operators]flush expired tokens and moves deleted instance<br>
</div>
<div><br>
</div>
<div xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Courier;
panose-1:2 7 4 9 2 2 5 2 4 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div lang="EN-GB" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">This is often mentioned as one of those items which catches every OpenStack cloud operator at some time. It’s not clear to me that there could not
be a scheduled job built into the system with a default frequency (configurable, ideally).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">If we are all configuring this as a cron job, is there a reason that it could not be built into the code ?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">Tim<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"><o:p> </o:p></span></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt">
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;">From:</span></b><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;"> Mike Smith [<a href="mailto:mismith@overstock.com">mailto:mismith@overstock.com</a>]
<br>
<b>Sent:</b> 24 January 2015 18:08<br>
<b>To:</b> Daniel Comnea<br>
<b>Cc:</b> OpenStack Development Mailing List (not for usage questions); <a href="mailto:openstack-operators@lists.openstack.org">
openstack-operators@lists.openstack.org</a><br>
<b>Subject:</b> Re: [Openstack-operators] [openstack-dev][openstack-operators]flush expired tokens and moves deleted instance<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">It is still mentioned in the Juno installation docs: <o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:8.0pt">By default, the Identity service stores expired tokens in the database indefinitely. The<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.0pt">accumulation of expired tokens considerably increases the database size and might degrade<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.0pt">service performance, particularly in environments with limited resources.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.0pt">We recommend that you use </span>
<span style="font-size:8.0pt;font-family:Courier">cron </span><span style="font-size:8.0pt">to configure a periodic task that purges expired tokens<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.0pt">hourly:<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:7.0pt;font-family:Courier"># (crontab -l -u keystone 2>&1 | grep -q token_flush) || \<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:7.0pt;font-family:Courier">echo '@hourly /usr/bin/keystone-manage token_flush >/var/log/keystone/<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:7.0pt;font-family:Courier">keystone-tokenflush.log 2>&1' \<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:7.0pt;font-family:Courier">>> /var/spool/cron/keystone<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:7.0pt;font-family:Courier"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:7.0pt;font-family:Courier"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
Mike Smith<br>
Principal Engineer, Website Systems<br>
<a href="http://Overstock.com">Overstock.com</a><br>
<br>
<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">On Jan 24, 2015, at 10:03 AM, Daniel Comnea <<a href="mailto:comnea.dani@gmail.com">comnea.dani@gmail.com</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">Hi all,<br>
<br>
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">I just bumped into Sebastien's blog where he suggested a cron job should run in production to tidy up expired tokens - see blog[1]<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">Could you please remind me if this is still required in IceHouse/ Juno? (i kind of remember i've seen some work being done in this direction but i can't find the emails)<br>
<br>
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks,<br>
Dani<br>
<br>
[1] <a href="http://www.sebastien-han.fr/blog/2014/08/18/a-must-have-cron-job-on-your-openstack-cloud/">
http://www.sebastien-han.fr/blog/2014/08/18/a-must-have-cron-job-on-your-openstack-cloud/</a><o:p></o:p></p>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
OpenStack-operators mailing list<br>
<a href="mailto:OpenStack-operators@lists.openstack.org">OpenStack-operators@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators</a><o:p></o:p></p>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="3" width="100%" align="center">
</div>
<p class="MsoNormal"><span style="font-size: 7.5pt; font-family: Arial, sans-serif; color: gray;"><br>
CONFIDENTIALITY NOTICE: This message is intended only for the use and review of the individual or entity to which it is addressed and may contain information that is privileged and confidential. If the reader of this message is not the intended recipient, or
the employee or agent responsible for delivering the message solely to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in
error, please notify sender immediately by telephone or return email. Thank you.</span><o:p></o:p></p>
</div>
</div>
</div>
</div>
</span><br>
<hr>
<font face="Arial" color="Gray" size="1">This E-mail and any of its attachments may contain Time Warner Cable proprietary information, which is privileged, confidential, or subject to copyright belonging to Time Warner Cable. This E-mail is intended solely
for the use of the individual or entity to which it is addressed. If you are not the intended recipient of this E-mail, you are hereby notified that any dissemination, distribution, copying, or action taken in relation to the contents of and attachments to
this E-mail is strictly prohibited and may be unlawful. If you have received this E-mail in error, please notify the sender immediately and permanently delete the original and any copy of this E-mail and any printout.<br>
</font>
</body>
</html>