feat: PUC-752: reading OIDCCryptoPassphrase from a file

[haseebsyed12]

Problem:
Unable to authenticate when the user receives the initial state, it is encrypted with a key from pod A, then user is redirected to the identity provided and finally when they get back through redirect, they may land on pod B which is no longer able to decrypt the state.

Solution:

OIDCCryptoPassphrase is a password used for encryption of the state cookie and cache entries and it must be the same on all replicas.

Previously we were setting the OIDCCryptoPassphrase to a random value that is generated on pod startup and multiple pods have different value.

[cardoe]

Can you write a description of why the change is needed to leave us some bread crumbs for future logic. I've recently found myself needing to refer to our commits in upstream OpenStack projects and our commits have been lacking in explanation which would be helpful.

[cardoe]

Suggested change

	default_pwgen() {
	"${SCRIPTS_DIR}/pwgen.sh" 2>/dev/null
	}
	# Custom password generator with only alphabets
	# shellcheck disable=SC2317
	alpha_only_pwgen() {
	head /dev/urandom | tr -dc A-Za-z | head -c 32
	}
	default_pwgen() {
	"${SCRIPTS_DIR}/pwgen.sh" 2>/dev/null
	}
	# Custom password generator with only alphabets
	# shellcheck disable=SC2317
	alpha_only_pwgen() {
	head /dev/urandom | tr -dc A-Za-z | head -c 32
	}

So we're not setting LC_ALL to C like the pwgen.sh script does. Let's instead add another parameter to pwgen.sh and let you specify the range.

So in that script do tr -dc ${2:-_A-Z-a-z-0-9}

[cardoe]

Suggested change

	data="$(${gen_func})"
	data="$("${SCRIPTS_DIR}/pwgen.sh" 32 "A-Za-z" 2>/dev/null)"