Process is Documented here: http://adam.younglogic.com/2016/09/fernet-overcloud/
As additional information, please consider adding a "note" in the official document stating that the keys in the controller nodes should not be changed manually. All controller nodes should have the exact same set of fernet keys, otherwise a token generated by one controller won't be accepted in another.