From 1e1e8daa69b713333f3710c2e2830c6b1c2e4b76 Mon Sep 17 00:00:00 2001 From: Pratik Lotia Date: Thu, 18 Dec 2025 17:23:30 -0500 Subject: [PATCH] Add support for attested node pruning configuration (#713) Expose SPIRE server's prune_attested_nodes_expired_for and prune_tofu_nodes configuration through new Helm values: pruneAttestedNodesExpiredFor and pruneTOFUNodes. This prevents database bloat from expired attested nodes in long-running deployments with node churn. Signed-off-by: pratik-lotia --- charts/spire/charts/spire-server/README.md | 2 ++ charts/spire/charts/spire-server/templates/configmap.yaml | 7 +++++++ charts/spire/charts/spire-server/values.yaml | 5 +++++ 3 files changed, 14 insertions(+) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index cb9585e..2563993 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -378,6 +378,8 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `agentTTL` | The TTL to use for agent SVIDs. If unset, the defaultX509SvidTTL will be used. | `""` | | `defaultX509SvidTTL` | TTL for X509 Svids | `4h` | | `defaultJwtSvidTTL` | TTL for JWT Svids | `1h` | +| `pruneAttestedNodesExpiredFor` | Enables periodic pruning of attested node entries with expired SVIDs. Set to a duration (e.g. "168h" for 7 days) to prune nodes that expired longer ago than the specified duration. Set to "" (empty) to disable pruning. When enabled, expired nodes are pruned at a regular interval. | `""` | +| `pruneTOFUNodes` | If true, includes non-reattestable (TOFU) nodes in the pruning process when pruneAttestedNodesExpiredFor is set. Banned nodes are never pruned. | `false` | | `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s nodeattestor | `true` | | `nodeAttestor.k8sPSAT.serviceAccountAllowList` | Allowed service accounts for PSAT nodeattestor. If namespace isn't specified, release namespace will be used. | `[]` | | `nodeAttestor.k8sPSAT.audience` | Audience for token validation. If set to [] (empty array), Kubernetes API server audience is used | `[]` | diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index 77966d7..1d306e2 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -64,6 +64,13 @@ server: default_x509_svid_ttl: {{ .Values.defaultX509SvidTTL | quote }} default_jwt_svid_ttl: {{ .Values.defaultJwtSvidTTL | quote }} + {{- if .Values.pruneAttestedNodesExpiredFor }} + prune_attested_nodes_expired_for: {{ .Values.pruneAttestedNodesExpiredFor | quote }} + {{- end }} + {{- if .Values.pruneTOFUNodes }} + prune_tofu_nodes: {{ .Values.pruneTOFUNodes }} + {{- end }} + ca_subject: - country: [{{ include "spire-server.ca-subject-country" . | quote }}] organization: [{{ include "spire-server.ca-subject-organization" . | quote }}] diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index b9d1b59..a9880ab 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -930,6 +930,11 @@ defaultX509SvidTTL: 4h ## @param defaultJwtSvidTTL TTL for JWT Svids defaultJwtSvidTTL: 1h +## @param pruneAttestedNodesExpiredFor Enables periodic pruning of attested node entries with expired SVIDs. Set to a duration (e.g. "168h" for 7 days) to prune nodes that expired longer ago than the specified duration. Set to "" (empty) to disable pruning. When enabled, expired nodes are pruned at a regular interval. +pruneAttestedNodesExpiredFor: "" +## @param pruneTOFUNodes If true, includes non-reattestable (TOFU) nodes in the pruning process when pruneAttestedNodesExpiredFor is set. Banned nodes are never pruned. +pruneTOFUNodes: false + nodeAttestor: k8sPSAT: ## @param nodeAttestor.k8sPSAT.enabled Enable PSAT k8s nodeattestor