meta-starlingx/meta-stx-integ/recipes-devtools/python/files/python-keystone/stx-files/keystone-fernet-keys-rotate-active

   1 #!/bin/bash
   2
   3 #
   4 # Wrapper script to rotate keystone fernet keys on active controller only
   5 #
   6 KEYSTONE_KEYS_ROTATE_INFO="/var/run/keystone-keys-rotate.info"
   7 KEYSTONE_KEYS_ROTATE_CMD="/usr/bin/nice -n 2 /usr/bin/keystone-manage fernet_rotate --keystone-user keystone --keystone-group keystone"
   8
   9 function is_active_pgserver()
  10 {
  11     # Determine whether we're running on the same controller as the service.
  12     local service=postgres
  13     local enabledactive=$(/usr/bin/sm-query service $service| grep enabled-active)
  14     if [ "x$enabledactive" == "x" ]
  15     then
  16         # enabled-active not found for that service on this controller
  17         return 1
  18     else
  19         # enabled-active found for that resource
  20         return 0
  21     fi
  22 }
  23
  24 if is_active_pgserver
  25 then
  26     if [ ! -f ${KEYSTONE_KEYS_ROTATE_INFO} ]
  27     then
  28         echo delay_count=0 > ${KEYSTONE_KEYS_ROTATE_INFO}
  29     fi
  30
  31     source ${KEYSTONE_KEYS_ROTATE_INFO}
  32     sudo -u postgres psql -d sysinv -c "SELECT alarm_id, entity_instance_id from i_alarm;" | grep -P "^(?=.*100.101)(?=.*${HOSTNAME})" &>/dev/null
  33     if [ $? -eq 0 ]
  34     then
  35         source /etc/platform/platform.conf
  36         if [ "${system_type}" = "All-in-one" ]
  37         then
  38             source /etc/init.d/task_affinity_functions.sh
  39             idle_core=$(get_most_idle_core)
  40             if [ "$idle_core" -ne "0" ]
  41             then
  42                 sh -c "exec taskset -c $idle_core ${KEYSTONE_KEYS_ROTATE_CMD}"
  43                 sed -i "/delay_count/s/=.*/=0/" ${KEYSTONE_KEYS_ROTATE_INFO}
  44                 exit 0
  45             fi
  46         fi
  47
  48         if [ "$delay_count" -lt "3" ]
  49         then
  50             newval=$(($delay_count+1))
  51             sed -i "/delay_count/s/=.*/=$newval/" ${KEYSTONE_KEYS_ROTATE_INFO}
  52             (sleep 3600; /usr/bin/keystone-fernet-keys-rotate-active) &
  53             exit 0
  54         fi
  55
  56     fi
  57
  58     eval ${KEYSTONE_KEYS_ROTATE_CMD}
  59     sed -i "/delay_count/s/=.*/=0/" ${KEYSTONE_KEYS_ROTATE_INFO}
  60
  61 fi
  62
  63 exit 0
  64