spiffe/spire
JWT signing key validity period not considered in calculation of bundle "spiffe_refresh_hint"
开放
#2,256 创建于 2021年5月6日
help wantedpriority/backlog
仓库指标
- 星标
- (2,443 个星标)
- PR 合并指标
- (PR 指标待抓取)
描述
- Version: 73f660bee008e1e4f8d310158c1258b65b53f959
- Platform: All
- Subsystem: Server
The spiffe_refresh_hint parameter of a bundle represents a suggestion for when a consumer should consider requesting a new version of the bundle, see SPIFFE Trust Domain and Bundle Section 4.1.2.
SPIRE currently only considers the lifetime of X.509 root CAs in the trust bundle for its calculation of this refresh hint. Today, SPIRE Server X.509 root CA and JWT signing keys have the same validity period, but ideally the refresh hint calculation should not depend on this assumption.