spiffe/spire

JWT signing key validity period not considered in calculation of bundle "spiffe_refresh_hint"

Open

#2,256 opened on May 6, 2021

View on GitHub
 (4 comments) (2 reactions) (0 assignees)Go (631 forks)auto 404
help wantedpriority/backlog

Repository metrics

Stars
 (2,443 stars)
PR merge metrics
 (PR metrics pending)

Description

  • Version: 73f660bee008e1e4f8d310158c1258b65b53f959
  • Platform: All
  • Subsystem: Server

The spiffe_refresh_hint parameter of a bundle represents a suggestion for when a consumer should consider requesting a new version of the bundle, see SPIFFE Trust Domain and Bundle Section 4.1.2.

SPIRE currently only considers the lifetime of X.509 root CAs in the trust bundle for its calculation of this refresh hint. Today, SPIRE Server X.509 root CA and JWT signing keys have the same validity period, but ideally the refresh hint calculation should not depend on this assumption.

Contributor guide

Research direction
Study the bundle refresh hint calculation in SPIRE server code, currently based only on X.509 root CA lifetime. Identify where JWT signing key validity is not considered and modify the calculation to incorporate JWT key expiration.
Tech stack
go
Domain
backend
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
GoSPIFFE/SPIRE concepts
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
60