spiffe/spire
JWT signing key validity period not considered in calculation of bundle "spiffe_refresh_hint"
オープン
#2,256 opened on 2021/05/06
help wantedpriority/backlog
Repository metrics
- Stars
- (2,443 個のスター)
- PR merge metrics
- (PR metrics pending)
説明
- Version: 73f660bee008e1e4f8d310158c1258b65b53f959
- Platform: All
- Subsystem: Server
The spiffe_refresh_hint parameter of a bundle represents a suggestion for when a consumer should consider requesting a new version of the bundle, see SPIFFE Trust Domain and Bundle Section 4.1.2.
SPIRE currently only considers the lifetime of X.509 root CAs in the trust bundle for its calculation of this refresh hint. Today, SPIRE Server X.509 root CA and JWT signing keys have the same validity period, but ideally the refresh hint calculation should not depend on this assumption.