Removed the deprecated pki_setup command

bp removed-as-of-pike

Change-Id: Ib39d21ed547e3be7a3a2c333a7193f990043a80b

doc/source/configuration.rst

@@ -949,29 +949,6 @@ If your certificate directory path is different from the default
 section of the configuration file.
 
 
-Generating a Signing Certificate using ``pki_setup``
-----------------------------------------------------
-
-``keystone-manage pki_setup`` is a development tool. We recommend that you do
-not use ``keystone-manage pki_setup`` in a production environment. In
-production, an external CA should be used instead. This is because the CA
-secret key should generally be kept apart from the token signing secret keys so
-that a compromise of a node does not lead to an attacker being able to generate
-valid signed keystone tokens. This is a low probability attack vector, as
-compromise of a keystone service machine's filesystem security almost certainly
-means the attacker will be able to gain direct access to the token backend.
-
-When using the ``keystone-manage pki_setup`` to generate the certificates, the
-following configuration options in the ``[signing]`` section are used:
-
-* ``ca_key`` - Default is ``/etc/keystone/ssl/private/cakey.pem``
-* ``key_size`` - Default is ``2048``
-* ``valid_days`` - Default is ``3650``
-
-If ``keystone-manage pki_setup`` is not used then these options don't need to
-be set.
-
-
 Service Catalog
 ===============
 

doc/source/man/commands.rst

@@ -22,6 +22,5 @@ Available commands:
 * ``mapping_populate``: Prepare domain-specific LDAP backend.
 * ``mapping_purge``: Purge the identity mapping table.
 * ``mapping_engine``: Test your federation mapping rules.
-* ``pki_setup``: Initialize the certificates used to sign revocation lists. **deprecated**
 * ``saml_idp_metadata``: Generate identity provider metadata.
 * ``token_flush``: Purge expired tokens.

keystone/cmd/cli.py

@@ -30,7 +30,6 @@
 from keystone.cmd import doctor
 from keystone.common import driver_hints
 from keystone.common import fernet_utils
-from keystone.common import openssl
 from keystone.common import sql
 from keystone.common.sql import upgrades
 from keystone.common import utils
@@ -582,44 +581,6 @@ def get_user_group():
         return keystone_user_id, keystone_group_id
 
 
-class BaseCertificateSetup(BasePermissionsSetup):
-    """Provides common options for certificate setup."""
-
-    @classmethod
-    def add_argument_parser(cls, subparsers):
-        parser = super(BaseCertificateSetup,
-                       cls).add_argument_parser(subparsers)
-        parser.add_argument('--rebuild', default=False, action='store_true',
-                            help=('Rebuild certificate files: erase previous '
-                                  'files and regenerate them.'))
-        return parser
-
-
-class PKISetup(BaseCertificateSetup):
-    """Setup keys and certificates for signing and verifying revocation lists.
-
-    This is NOT intended for production use, see Keystone Configuration
-    documentation for details. As of the Mitaka release, this command has
-    been DEPRECATED and may be removed in the 'O' release.
-    """
-
-    name = 'pki_setup'
-
-    @classmethod
-    def main(cls):
-        versionutils.report_deprecated_feature(
-            LOG,
-            "keystone-manage pki_setup is deprecated as of Mitaka in "
-            "favor of not using PKI tokens and may be removed in 'O' "
-            "release.")
-        LOG.warning('keystone-manage pki_setup is not recommended for '
-                    'production use.')
-        keystone_user_id, keystone_group_id = cls.get_user_group()
-        conf_pki = openssl.ConfigurePKI(keystone_user_id, keystone_group_id,
-                                        rebuild=CONF.command.rebuild)
-        conf_pki.run()
-
-
 class FernetSetup(BasePermissionsSetup):
     """Setup a key repository for Fernet tokens.
 
@@ -1336,7 +1297,6 @@ def main(cls):
     MappingPopulate,
     MappingPurge,
     MappingEngineTester,
-    PKISetup,
     SamlIdentityProviderMetadata,
     TokenFlush,
 ]