spiffe/spire
JWT signing key validity period not considered in calculation of bundle "spiffe_refresh_hint"
開放
#2,256 建立於 2021年5月6日
help wantedpriority/backlog
倉庫指標
- 星標
- (2,443 顆星)
- PR 合併指標
- (平均合併 9天 14小時) (30 天內合併 44 個 PR)
描述
- Version: 73f660bee008e1e4f8d310158c1258b65b53f959
- Platform: All
- Subsystem: Server
The spiffe_refresh_hint parameter of a bundle represents a suggestion for when a consumer should consider requesting a new version of the bundle, see SPIFFE Trust Domain and Bundle Section 4.1.2.
SPIRE currently only considers the lifetime of X.509 root CAs in the trust bundle for its calculation of this refresh hint. Today, SPIRE Server X.509 root CA and JWT signing keys have the same validity period, but ideally the refresh hint calculation should not depend on this assumption.