Bug 1432479 - [RFE] Providing key rotation for Fernet tokens
Summary: [RFE] Providing key rotation for Fernet tokens
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: openstack-tripleo-common
Version: 12.0 (Pike)
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: Upstream M2
: 12.0 (Pike)
Assignee: Toure Dunnon
QA Contact: Prasanth Anbalagan
URL:
Whiteboard:
Depends On:
Blocks: 1442136 1469332
TreeView+ depends on / blocked
 
Reported: 2017-03-15 13:31 UTC by Keith Basil
Modified: 2020-07-16 09:18 UTC (History)
11 users (show)

Fixed In Version: openstack-tripleo-common-7.3.1-0.20170707111135.d8a74de.el7ost openstack-tripleo-heat-templates-7.0.0-0.20170706121722.el7ost
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-12-13 21:17:04 UTC
Target Upstream Version:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
OpenStack gerrit 473387 0 'None' 'MERGED' 'Add KeystoneFernetKeys to generated passwords' 2019-11-26 08:41:56 UTC
OpenStack gerrit 473388 0 'None' 'MERGED' 'Create mistral action to rotate fernet keys from passwords variable' 2019-11-26 08:41:56 UTC
OpenStack gerrit 473389 0 'None' 'MERGED' 'Use KeystoneFernetKeys instead of individual parameters' 2019-11-26 08:41:56 UTC
OpenStack gerrit 473390 0 'None' 'MERGED' 'Enable heat/puppet to manage the fernet keys and make it configurable' 2019-11-26 08:41:56 UTC
OpenStack gerrit 474532 0 'None' 'MERGED' 'Make fernet max active keys configurable' 2019-11-26 08:41:56 UTC
OpenStack gerrit 474573 0 'None' 'MERGED' 'Add fernet keys purging based no t-h-t parameter' 2019-11-26 08:41:57 UTC
OpenStack gerrit 474574 0 'None' 'MERGED' 'Enable key rotation action and add release note' 2019-11-26 08:41:57 UTC
OpenStack gerrit 475732 0 'None' 'MERGED' 'Add workbook to rotate fernet keys' 2019-11-26 08:41:57 UTC
Red Hat Product Errata RHEA-2017:3462 0 normal SHIPPED_LIVE Red Hat OpenStack Platform 12.0 Enhancement Advisory 2018-02-16 01:43:25 UTC

Description Keith Basil 2017-03-15 13:31:30 UTC 
The Fernet driver is not secure enough because we don't have keys rotations at this time.  The RFE here is to provide a solution to perform Keystone Fernet tokens rotation in a way that scales and is secure.
Comment 12 errata-xmlrpc 2017-12-13 21:17:04 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2017:3462
Note You need to log in before you can comment on or make changes to this bug.