panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add support for attested node pruning configuration (#713)

Browse Source 
Expose SPIRE server's prune_attested_nodes_expired_for and prune_tofu_nodes
configuration through new Helm values: pruneAttestedNodesExpiredFor and
pruneTOFUNodes.

This prevents database bloat from expired attested nodes in long-running
deployments with node churn.

Signed-off-by: pratik-lotia <[email protected]>
This commit is contained in:
Pratik Lotia
2025-12-18 14:23:30 -08:00
committed by GitHub
parent eb60ff0ed3
commit 1e1e8daa69
3 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/values.yaml
+5
View File
@@ -930,6 +930,11 @@ defaultX509SvidTTL: 4h
## @param defaultJwtSvidTTL TTL for JWT Svids
defaultJwtSvidTTL: 1h
## @param pruneAttestedNodesExpiredFor Enables periodic pruning of attested node entries with expired SVIDs. Set to a duration (e.g. "168h" for 7 days) to prune nodes that expired longer ago than the specified duration. Set to "" (empty) to disable pruning. When enabled, expired nodes are pruned at a regular interval.
pruneAttestedNodesExpiredFor: ""
## @param pruneTOFUNodes If true, includes non-reattestable (TOFU) nodes in the pruning process when pruneAttestedNodesExpiredFor is set. Banned nodes are never pruned.
pruneTOFUNodes: false
nodeAttestor:
k8sPSAT:
## @param nodeAttestor.k8sPSAT.enabled Enable PSAT k8s nodeattestor