panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add support for attested node pruning configuration (#713)

Browse Source 
Expose SPIRE server's prune_attested_nodes_expired_for and prune_tofu_nodes
configuration through new Helm values: pruneAttestedNodesExpiredFor and
pruneTOFUNodes.

This prevents database bloat from expired attested nodes in long-running
deployments with node churn.

Signed-off-by: pratik-lotia <[email protected]>
This commit is contained in:
Pratik Lotia
2025-12-18 14:23:30 -08:00
committed by GitHub
parent eb60ff0ed3
commit 1e1e8daa69
3 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/README.md
+2
View File
@@ -378,6 +378,8 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `agentTTL` | The TTL to use for agent SVIDs. If unset, the defaultX509SvidTTL will be used. | `""` | | `agentTTL` | The TTL to use for agent SVIDs. If unset, the defaultX509SvidTTL will be used. | `""` |
| `defaultX509SvidTTL` | TTL for X509 Svids | `4h` | | `defaultX509SvidTTL` | TTL for X509 Svids | `4h` |
| `defaultJwtSvidTTL` | TTL for JWT Svids | `1h` | | `defaultJwtSvidTTL` | TTL for JWT Svids | `1h` |
| `pruneAttestedNodesExpiredFor` | Enables periodic pruning of attested node entries with expired SVIDs. Set to a duration (e.g. "168h" for 7 days) to prune nodes that expired longer ago than the specified duration. Set to "" (empty) to disable pruning. When enabled, expired nodes are pruned at a regular interval. | `""` |
| `pruneTOFUNodes` | If true, includes non-reattestable (TOFU) nodes in the pruning process when pruneAttestedNodesExpiredFor is set. Banned nodes are never pruned. | `false` |
| `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s nodeattestor | `true` | | `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s nodeattestor | `true` |
| `nodeAttestor.k8sPSAT.serviceAccountAllowList` | Allowed service accounts for PSAT nodeattestor. If namespace isn't specified, release namespace will be used. | `[]` | | `nodeAttestor.k8sPSAT.serviceAccountAllowList` | Allowed service accounts for PSAT nodeattestor. If namespace isn't specified, release namespace will be used. | `[]` |
| `nodeAttestor.k8sPSAT.audience` | Audience for token validation. If set to [] (empty array), Kubernetes API server audience is used | `[]` | | `nodeAttestor.k8sPSAT.audience` | Audience for token validation. If set to [] (empty array), Kubernetes API server audience is used | `[]` |
charts/spire/charts/spire-server/templates/configmap.yaml
+7
View File
@@ -64,6 +64,13 @@ server:
default_x509_svid_ttl: {{ .Values.defaultX509SvidTTL | quote }} default_x509_svid_ttl: {{ .Values.defaultX509SvidTTL | quote }}
default_jwt_svid_ttl: {{ .Values.defaultJwtSvidTTL | quote }} default_jwt_svid_ttl: {{ .Values.defaultJwtSvidTTL | quote }}
{{- if .Values.pruneAttestedNodesExpiredFor }}
prune_attested_nodes_expired_for: {{ .Values.pruneAttestedNodesExpiredFor | quote }}
{{- end }}
{{- if .Values.pruneTOFUNodes }}
prune_tofu_nodes: {{ .Values.pruneTOFUNodes }}
{{- end }}
ca_subject: ca_subject:
- country: [{{ include "spire-server.ca-subject-country" . | quote }}] - country: [{{ include "spire-server.ca-subject-country" . | quote }}]
organization: [{{ include "spire-server.ca-subject-organization" . | quote }}] organization: [{{ include "spire-server.ca-subject-organization" . | quote }}]
charts/spire/charts/spire-server/values.yaml
+5
View File
@@ -930,6 +930,11 @@ defaultX509SvidTTL: 4h
## @param defaultJwtSvidTTL TTL for JWT Svids ## @param defaultJwtSvidTTL TTL for JWT Svids
defaultJwtSvidTTL: 1h defaultJwtSvidTTL: 1h
## @param pruneAttestedNodesExpiredFor Enables periodic pruning of attested node entries with expired SVIDs. Set to a duration (e.g. "168h" for 7 days) to prune nodes that expired longer ago than the specified duration. Set to "" (empty) to disable pruning. When enabled, expired nodes are pruned at a regular interval.
pruneAttestedNodesExpiredFor: ""
## @param pruneTOFUNodes If true, includes non-reattestable (TOFU) nodes in the pruning process when pruneAttestedNodesExpiredFor is set. Banned nodes are never pruned.
pruneTOFUNodes: false
nodeAttestor: nodeAttestor:
k8sPSAT: k8sPSAT:
## @param nodeAttestor.k8sPSAT.enabled Enable PSAT k8s nodeattestor ## @param nodeAttestor.k8sPSAT.enabled Enable PSAT k8s nodeattestor