pvestatd: rotate auth keys if necessary

as a fallback to ensure rotation even if no logins happen on a given
cluster.

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>

diff --git a/PVE/Service/pvestatd.pm b/PVE/Service/pvestatd.pm
index 2c8454d64f4ab0e6d1d9dbfad94693ecafad2249..ce2adbbd4fd724f9a258f6148f51fe7e24721449 100755 (executable)
--- a/PVE/Service/pvestatd.pm
+++ b/PVE/Service/pvestatd.pm
@@ -21,6 +21,7 @@ use PVE::LXC::Config;
 use PVE::RPCEnvironment;
 use PVE::API2::Subscription;
 use PVE::AutoBalloon;
+use PVE::AccessControl;
 
 use PVE::Status::Plugin;
 use PVE::Status::Graphite;
@@ -440,6 +441,10 @@ sub update_storage_status {
     }
 }
 
+sub rotate_authkeys {
+    PVE::AccessControl::rotate_authkey() if !PVE::AccessControl::check_authkey(1);
+}
+
 sub update_status {
 
     # update worker list. This is not really required and
@@ -491,6 +496,13 @@ sub update_status {
     };
     $err = $@;
     syslog('err', "lxc console cleanup error: $err") if $err;
+
+    eval {
+       rotate_authkeys();
+    };
+    $err = $@;
+    syslog('err', "authkey rotation error: $err") if $err;
+
 }
 
 my $next_update = 0;