Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1482240

Summary: [docs][keystone] Fix Tuning_the_Undercloud for keystone token flush job
Product: Red Hat OpenStack Reporter: Andreas Karis <akaris>
Component: documentationAssignee: Martin Lopes <mlopes>
Status: CLOSED DUPLICATE QA Contact: Charelle Collett <ccollett>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 10.0 (Newton)CC: akaris, jjoyce, mlopes, pkovacs, srevivo
Target Milestone: ---Keywords: Documentation
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-09-05 04:55:42 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Andreas Karis 2017-08-16 20:23:10 UTC 
https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/10/html-single/director_installation_and_usage/#sect-Tuning_the_Undercloud

The current doc reads:
~~~
10.8. Tuning the Undercloud

The advice in this section aims to help increase the performance of your undercloud. Implement the recommendations as necessary.

    The OpenStack Authentication service (keystone) uses a token-based system for access to other OpenStack services. After a certain period, the database accumulates many unused tokens. It is recommended you create a cronjob to flush the token table in the database. For example, to flush the token table at 4 a.m. each day:

    0 04 * * * /bin/keystone-manage token_flush
~~~

OSP 8/9/10/11 configure a token flush cronjob by default (this slightly depends on the version of OSP, but it's more or less like the following in OSP 10):
~~~
[root@overcloud-controller-0 ~]# crontab -u keystone -l
# HEADER: This file was autogenerated at 2017-08-03 23:23:33 +0000 by puppet.
# HEADER: While it can still be managed manually, it is definitely not recommended.
# HEADER: Note particularly that the comments starting with 'Puppet Name' should
# HEADER: not be deleted, as doing so could cause duplicate cron jobs.
# Puppet Name: keystone-manage token_flush
PATH=/bin:/usr/bin:/usr/sbin SHELL=/bin/sh
1 0 * * * sleep `expr ${RANDOM} \% 3600`; keystone-manage token_flush >>/dev/null 2>&1
~~~

Meaning that our doc should rather be:
~~~
  The OpenStack Authentication service (keystone) uses a token-based system for access to other OpenStack services. After a certain period, the database accumulates many unused tokens. The default cronjob flushes the token table every day. It is recommended that you monitor your environment and adjust the token flush interval as needed.
~~~

Then, this should link to or include https://access.redhat.com/solutions/3092331 and for OSP 11 it would be: https://access.redhat.com/solutions/3083521
Comment 1 Peter Kovacs 2017-08-16 21:24:19 UTC 
OSP 8 seems to be the last release where the keystone token_flush crontab needs to be added manually.
The 'Tuning the undercloud' chapter needs to be updated for every newer release (9,10,11) since they already have this crontab out of the box.
Comment 15 Martin Lopes 2017-09-05 04:55:42 UTC 
Undercloud keystone flush note was updated in the guide:

https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/11/html-single/director_installation_and_usage/#sect-Tuning_the_Undercloud

Moving the remaining overcloud work to BZ#1467120

*** This bug has been marked as a duplicate of bug 1467120 ***