Browse code
Always cache tokens in a shared memcache
Instead of using in-process caching for tokens per service per
worker (disabled by default now), use a shared memcache to cache
token validation(s). This should both offload/speedup validations
and avoid the issues surrounding inconsistent validation responses
when using in-process caching [since each worker caches separately].
Conflicts:
files/debs/keystone
files/rpms/keystone
Change-Id: Ifc17c27744dac5ad55e84752ca6f68169c2f5a86
(cherry picked from commit afd84acd0313ff6edde0cc7a6bc7c3e0bab7ac8c)
Morgan Fainberg authored on 2016/01/21 05:43:22Showing 4 changed files
| ... | ... |
@@ -443,6 +443,7 @@ function configure_auth_token_middleware {
|
| 443 | 443 |
iniset $conf_file $section auth_uri $KEYSTONE_SERVICE_URI |
| 444 | 444 |
iniset $conf_file $section cafile $SSL_BUNDLE_FILE |
| 445 | 445 |
iniset $conf_file $section signing_dir $signing_dir |
| 446 |
+ iniset $conf_file $section memcache_servers 127.0.0.1:11211 |
|
| 446 | 447 |
} |
| 447 | 448 |
|
| 448 | 449 |
# init_keystone() - Initialize databases, etc. |
| ... | ... |
@@ -512,17 +513,11 @@ function install_keystone {
|
| 512 | 512 |
if is_service_enabled ldap; then |
| 513 | 513 |
install_ldap |
| 514 | 514 |
fi |
| 515 |
- if [[ "$KEYSTONE_TOKEN_BACKEND" = "memcache" ]]; then |
|
| 516 |
- # Install memcached and the memcache Python library that keystone uses. |
|
| 517 |
- # Unfortunately the Python library goes by different names in the .deb |
|
| 518 |
- # and .rpm circles. |
|
| 519 |
- install_package memcached |
|
| 520 |
- if is_ubuntu; then |
|
| 521 |
- install_package python-memcache |
|
| 522 |
- else |
|
| 523 |
- install_package python-memcached |
|
| 524 |
- fi |
|
| 525 |
- fi |
|
| 515 |
+ |
|
| 516 |
+ # Install the memcache library so keystonemiddleware can cache tokens in a |
|
| 517 |
+ # shared location. |
|
| 518 |
+ pip_install python-memcached |
|
| 519 |
+ |
|
| 526 | 520 |
git_clone $KEYSTONE_REPO $KEYSTONE_DIR $KEYSTONE_BRANCH |
| 527 | 521 |
setup_develop $KEYSTONE_DIR |
| 528 | 522 |
if [ "$KEYSTONE_USE_MOD_WSGI" == "True" ]; then |
| ... | ... |
@@ -566,6 +561,9 @@ function start_keystone {
|
| 566 | 566 |
start_tls_proxy '*' $KEYSTONE_SERVICE_PORT $KEYSTONE_SERVICE_HOST $KEYSTONE_SERVICE_PORT_INT & |
| 567 | 567 |
start_tls_proxy '*' $KEYSTONE_AUTH_PORT $KEYSTONE_AUTH_HOST $KEYSTONE_AUTH_PORT_INT & |
| 568 | 568 |
fi |
| 569 |
+ |
|
| 570 |
+ # (re)start memcached to make sure we have a clean memcache. |
|
| 571 |
+ restart_service memcached |
|
| 569 | 572 |
} |
| 570 | 573 |
|
| 571 | 574 |
# stop_keystone() - Stop running processes |